Debian & general comment

3.3.4 has been in Gentoo-testing since 17Aug, stable on x86 on 4Sep *. Tho I'm not sure if Gentoo counts as a major distro.
More importantly, the LO project seriously needs to re-evaluate its policies on this. There's plenty of arguments for immediate as well as for delayed disclosure (I don't think that topic needs any further lengthy discussions), but afaik there's universal agreement that you always say when an update includes security fixes (or at least, like the kernel, say "this might include security fixes, everyone should update immediately"). Still, at least they fixed it.

Oh and if the AOO-project still can't watch its security mailbox it should probably advice people to go to LO instead until they had time to get setup with their duplicate project...

*: http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/a...