The ESRI Support Services blog has a statement about Heartbleed, which refers users to this tech article:
The Heartbleed Bug – What does it mean for you?
As you may or may not be aware, a recent security vulnerability was
unveiled for servers using the OpenSSL cryptographic library that
affects many different products and software worldwide. This
vulnerability has been codenamed ‘The Heartbleed Bug’, and potentially
allows attackers to read the memory of a protected server or client
and retrieve encrypted personal information from that server/client.
As a result, Esri staff have been performing maintenance to validate,
secure, and patch Esri servers and infrastructure to close this
vulnerability and ensure Esri customers are protected.
Please read the following KB Article for further information regarding
the Heartbleed bug and whether any customer action is required for
your Esri software.
A note about the desktop software out of the tech article:
ArcGIS for Desktop/Engine – No customer action is required. The
vulnerable OpenSSL library is included with ArcGIS Desktop releases
10.1 SP1, 10.2, 10.2.1, and 10.2.2, but it is not utilized in a manner where the vulnerability is exploitable.
ArcGIS Runtime – No customer action is required. The vulnerable
OpenSSL library is included with Runtime WPF/Qt/Java releases 10.1.1,
10.2, 10.2.2, and the iOS/Android 10.2.2 release, but it is not utilized in a manner where the vulnerability is exploitable.
There is a potentially exploitable vulnerability in ArcGIS Server for for Linux, according to this article:
ArcGIS for Server on Linux 10.2, 10.2.1, and 10.2.2 are vulnerable,
not as a server, but as a client to other servers which happens only
in the Print Service and Publishing Services when they connect to
remote ArcGIS Servers. That means that encryption for ArcGIS for
Server on Linux has not been compromised. However, it means that
attackers may be able to discover where ArcGIS for Server has been
installed, the name of the running user, and potentially even be able
to crash the print service.
A patch will be available shortly to address the issue for ArcGIS
Server on Linux.