Hello, there was a double free issue discovered in openssl. This might be used for remote code injection/execution. See http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0085.html or http://www.heise.de/security/meldung/Schwachstelle-in-OpenSSL-1-0-x-1053085.html
I have applied the proposed upstream patch http://marc.info/?l=openssl-dev&m=128129628800826&w=2 (it's not in cvs yet though, but at least it should not harm) Of course the test suite is still passed and the mention cert no longer crashes openssl. Please sign off. Pierre -- Pierre Schmitz, https://users.archlinux.de/~pierre
