Repeat it all back to me.' (The requests can be up to 64 KB long.) When Yahoo's servers receive that message, they allocate a memory buffer - a region of physical memory where it can store information - that's 40 KB long, based on the reported length of the heartbeat request. So, for example, if you're reading your Yahoo mail but haven't done anything in a while to load more information, your web browser might send a signal to Yahoo's servers saying, in essence, 'This is a 40 KB message you're about to get. Crucially, the heartbeat request includes information about its own length. The second computer will reply back with the exact same encrypted piece of data, proving that the connection is still in place. Occasionally, one of the computers will send an encrypted piece of data, called a heartbeat request, to the other. Essentially, this is how the two computers communicating with one another let each other know that they're still connected even if the user isn't downloading or uploading anything at the moment. One important part of the TLS/SSL protocols is what's called a heartbeat. To understand how the Heartbleed vulnerability ( CVE-2014-0160) works, you need to know a little bit about how the TLS/SSL protocols operate, and how computers store information in memory. The TLS/SSL standards are crucial for modern web encryption, and while the flaw was in the OpenSSL implementation rather than the standards themselves, OpenSSL is so widely used - when the bug was made public, it affected 17% of all SSL servers - that it precipitated a security crisis. In short, a malicious user could easily trick a vulnerable web server into sending sensitive information, including usernames and passwords.

Heartbleed was caused by a flaw in OpenSSL, an open source code library that implemented the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. Heartbleed is a vulnerability that came to light in April of 2014 it allowed attackers unprecedented access to sensitive information, and it was present on thousands of web servers, including those running major sites like Yahoo.

Mem patch paste request here