Here's a writeup of CVE-2015-1788:<p><a href="https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang/" rel="nofollow">https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang...</a><p>It's embarrassing rather than terribly dangerous.<p>edit: Please note: there are other issues in this advisory. You should read the advisory, first and foremost.
Good luck in updating it in OS X (try running `ssh -V` there). Good that OS X will update to a more recent version in El Capitan and also switch to LibreSSL (great step forward).
<i>"X509_cmp_time does not properly check the length of the ASN1_TIME string and can read a few bytes out of bounds."</i><p>OpenSSL in C has had range errors discovered for over a decade now. Short of going to a safe language or full machine proofs of correctness, it's never going to be fixed. "Many eyes" don't help.<p>(Of course, one wonders how many OpenSSL security holes are deliberate backdoors.)