The OpenSSL update is at least responding to this advisory since we're getting the version mentioned as being "safe". But that advisory is already three weeks old and I'm running a newer version than 0.9.6e on my other unix machines. Three weeks isn't horribly slow turnaround time but I still wouldn't be very happy if I were running an os x server box.