...
VU#925211 in the OpenSSL package for Debian Linux, and other distributions derived from Debian, is said to reference uninitialized memory. One might say that uninitialized memory caused the vulnerability, but not directly. The original OpenSSL code utilized used uninitialized memory as an additional source of randomness to an already-randomly-generated key. This generated good keys, but caused the code-auditing tools Valgrind and Purify to issue warnings. Debian tried to fix the warnings with two changes. One actually eliminated the uninitialized memory access, but the other weakened the randomness of the keys.
...