Not sure how it affects bitcoin.
It shouldn't. The vulnerability is in the gethostbyname() function, specifically that if it is given an IP address instead of a domain name, it just returns the IP address itself (which is reasonable) with no bounds checking on the length of the IP address (they're always less than 16 characters, right?), leading to a buffer overflow if it is given a bogus IP address containing impossibly large numbers (whoops). This function is obsolete, replaced by getaddrinfo(), which has no such vulnerability, and as far as I can tell Bitcoin doesn't use the vulnerable function.The function is obsolete on newer systems but still on use in some older systems e.g.:
http://www.ubuntu.com/usn/usn-2485-1/ (ubuntu 12.04 and 10.04)
I'm not sure how it affects bitcoin directly. Don't think it uses the function. Of course if bitcoin is a on a vulnerable system there is of course a risk in any case.
