Apparently there is a serious bug in 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including
1.0.1f and 1.0.2-beta1, as reported at https://www.openssl.org/news/secadv_20140407.txt
I have downloaded the purported fix openssl-1.0.1g.tar.gz from https://www.openssl.org/source/
However, if there are installation instructions, I am at a loss to find them. Anybody figure it out yet?