Tavis Ormandy and Will Drewry of the Google Security Team discovered a 
possible DoS in the sslv2 client code.  Where a client application uses 
OpenSSL to make a SSLv2 connection to a malicious server that server 
could cause the client to crash.  CVE-2006-4343

--- ssl/s2_clnt.c	2005-08-06 00:52:07.000000000 +0100
+++ ssl/s2_clnt.c	2006-08-28 19:14:59.398605000 +0100
@@ -520,7 +520,8 @@ static int get_server_hello(SSL *s)
 		CRYPTO_add(&s->session->peer->references, 1, CRYPTO_LOCK_X509);
 		}
 
-	if (s->session->peer != s->session->sess_cert->peer_key->x509)
+	if (s->session->sess_cert == NULL 
+      || s->session->peer != s->session->sess_cert->peer_key->x509)
 		/* can't happen */
 		{
 		ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);