The OpenSSL project has reported fixes for several vulnerabilities, at least one of them serious.

The most significant vulnerability is SSL/TLS MITM vulnerability (CVE-2014-0224). Unlike Heartbleed, which had been introduced into the program not long before, affects all versions of OpenSSL, including those that were patched to fix Heartbleed.

All client versions of OpenSSL are vulnerable. OpenSSL servers are only known to be vulnerable in versions 1.0.1 and 1.0.2-beta1. The bug was discovered by KIKUCHI Masashi (Lepidum Co. Ltd.) and reported to OpenSSL on May 1 via JPCERT/CC. Kikuchi has published his own explanation of the bug.

OpenSSL provides this advice:

OpenSSL 0.9.8 DTLS users should upgrade to 0.9.8za

OpenSSL 1.0.0 DTLS users should upgrade to 1.0.0m

OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1h

[UPDATE: Google's Adam Langley has written an analysis of the bug. As he notes: "... these attacks need man-in-the-middle position against the victim and that non-OpenSSL clients (IE, Firefox, Chrome on Desktop and iOS, Safari etc) aren't affected. None the less, all OpenSSL users should be updating." He adds (on Twitter) that Chrome on Android does use OpenSSL, but he has not confirmed that it is vulnerable.]

[UPDATE 2: Google has released a new version of Chrome for Android, incrementing the OpenSSL version used in it to 1.0.1h.]

The same updates fix several less-serious issues: