Hello, I have seen two or three questions but no answer on this list. What is the status of vulnerabilities announced on http://www.openssl.org/ from 17-Mar-2003 and 19-Mar-2003. Are the debian packages vulnerable? I'm not sure whether i should wait for updated packages, file a bug against libssl0.9.6, and/or just patch/compile everything by hand and remove corresponding debian packages. Pavel Jurus