[kevincox]

Well it was originally found 5 years ago. However StartSSL redesigned their site less then a year ago where I would guess the vulnerability came back (not that I have any knowledge to back that up).