AIX

1. CVE-2014-3566 - SSL protocol 3.0 uses nondeterministic CBC padding, which makes it easier
for man-in-the-middle attackers to obtain cleartext data via a padding-oracle
attack.

2. CVE-2014-3567 - OpenSSL could allow remote attackers to cause a denial of service (memory consumption)
via crafted session ticket that triggers an integrity-check failure.

3. CVE-2014-3505 - OpenSSL could allow remote attackers to cause a denial of service
(application crash) via crafted DTLS packets that trigger an error condition.

4. CVE-2014-3506 - OpenSSL could allow remote attackers to cause a denial of service
(memory consumption) via crafted DTLS handshake messages that trigger memory
allocations corresponding to large length values.

5. CVE-2014-3507 - OpenSSL could allow remote attackers to cause a denial of service
(memory consumption) via zero-length DTLS fragments that trigger improper
handling of the return value of insert function.

6. CVE-2014-3508 - OpenSSL could allow context-dependent attackers to obtain sensitive information
from process stack memory by reading output from some functions when pretty
printing is used

7. CVE-2014-3510 - OpenSSL could allow remote DTLS servers to cause a denial of service
(NULL pointer dereference and client application crash) via a crafted
handshake message in conjunction with a (1) anonymous DH or
(2) anonymous ECDH ciphersuite.

8. CVE-2014-0195 - A buffer overrun attack can be triggered by sending invalid DTLS fragments
to an OpenSSL DTLS client or server. This is potentially exploitable to run arbitrary
code on a vulnerable client or server.

9. CVE-2014-0221 - By sending an invalid DTLS handshake to an OpenSSL DTLS client the code
can be made to recurse eventually crashing in a DoS attack.

10. CVE-2014-0224 - An attacker using a carefully crafted handshake can force the use of weak
keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a
Man-in-the-middle (MITM) attack where the attacker can decrypt and modify traffic
from the attacked client and server.

11. CVE-2014-3470 - OpenSSL TLS clients enabling anonymous ECDH ciphersuites are subject to a
denial of service attack.

12.CVE-2014-0076 - The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure
that certain swap operations have a constant-time behavior, which makes it easier
for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack.

1. CVE-2015-0293 - Remote attackers can cause a Denial of Service (assertion failure and
daemon exit) via crafted CLIENT-MASTER-KEY message.

2. CVE-2015-0292 - Remote attackers can cause a Denial of Service (memory corruption) via
crafted base64 data that triggers a buffer overflow.

3. CVE-2015-0289 - Remote attackers can cause a Denial of Service (NULL pointer dereference
and application crash) by leveraging an application that processes arbitrary
PKCS#7 data and providing malformed data with ASN.1 encoding

4. CVE-2015-0288 - Remote attackers can cause a Denial of Service (NULL pointer dereference
and application crash) via an invalid certificate key

5. CVE-2015-0287 - Remote attackers can cause a Denial of Service (invalid write operation
and memory corruption) by leveraging an application that relies on ASN.1
structure reuse

6. CVE-2015-0286 - Remote attackers can cause a Denial of Service (invalid read operation and
application crash) via a crafted X.509 certificate to an endpoint that uses
the certificate-verification feature

7. CVE-2015-0209 - Remote attackers can cause a Denial of Service (memory corruption and application
crash) via a malformed Elliptic Curve (EC) private-key file that is improperly
handled during import

8. CVE-2015-0204 - OpenSSL allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks
and facilitate brute-force decryption by offering a weak ephemeral RSA key in a
noncompliant role.

9. CVE-2014-8275 - OpenSSL does not enforce certain constraints on certificate data, which allows remote
attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by
including crafted data within a certificate's unsigned portion

10. CVE-2014-3571 - OpenSSL allows remote attackers to cause a denial of service via a crafted DTLS message
that is processed with a different read operation for the handshake header than for the
handshake body

11. CVE-2014-3570 - OpenSSL does not properly calculate the square of a BIGNUM value, which might make it
easier for remote attackers to defeat cryptographic protection mechanisms via unspecified
vectors

This is OpenSSH-6.0p1 (6.0.0.6102) for AIX 5.3, AIX 6.1 and AIX 7.1.
This version of OpenSSH is compiled with OpenSSL 0.9.8x.

Originally Posted by MichaelFelt

If I recall correctly, the *.2500 openssl packaging was FIPS certified- so these were not even standard 0.9.8 openssl copies.