Use after free bug in OpenSSL

It&#x27;s good to see that one of the positive effects of Heartbleed is that it motivated people to inspect OpenSSL&#x27;s code, leading to more bugs being found and fixed.<p>This is supposed to be how open-source works; it&#x27;s unfortunate that it had to take a huge vulnerability to cause this motivation.

I believe this is the same patch as previously written about here on April 10th: <a href="http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse" rel="nofollow">http:&#x2F;&#x2F;www.tedunangst.com&#x2F;flak&#x2F;post&#x2F;analysis-of-openssl-free...</a>

One may consider Mozilla&#x27;s NSS library (Netscape invented SSL, &quot;Network Security Services&quot;) as an alternative to OpenSSL. It has an compatible API layer (extra package), is used by Firefox, (Chrome), OpenOffice and has more sane default settings. Check out the comparison tables: <a href="http://en.wikipedia.org/wiki/Comparison_of_TLS_Implementations" rel="nofollow">http:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Comparison_of_TLS_Implementatio...</a>

I wish Theo and his colleagues would create a fork of OpenSSL that was up to OpenBSD&#x2F;OpenSSH standards. It would be a huge level of work, but I&#x27;d happily donate to help fund it.

Sorry if this is a silly question, but is this simply the Heartbleed bug? Or is this a different memory leak bug?

It seems like someone should start a Sourceforge for security project; a place that tracks and does high quality static analysis of open source projects, and makes the reports readily available.

That&#x27;s pretty sick. I&#x27;d rather have bugs fixed now than later.<p>Another!

Anyone known a real alternative to SSL to secure communications? No GPG, POW(or bitcoin, similar, etc.)

I think that this is a good sign. I know everyone has been saying that OpenSSL code is terrible (can&#x27;t say I have looked myself), but if this is the worst bug found since heartbleed then maybe it is better than it appears.

It appears Heartbleed has riled up the Hound dogs. It&#x27;s unfortunate the funds aren&#x27;t available for bug bounties in OpenSSL.

Are we going to post every new OpenSSL bug until everyone switches to miTLS?

What is up with that patch command? Why not<p><pre><code> cd &#x2F;usr&#x2F;src; patch -p0 &lt;&#x2F;path&#x2F;008_openssl.patch ?</code></pre>