> There is still no working patch.

Is this still true? On Ubuntu we got another update today:

      * SECURITY UPDATE: incomplete fix for CVE-2014-6271
        - debian/patches/CVE-2014-7169.diff: fix logic in parse.y.
        - CVE-2014-7169
    
     -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 25 Sep 2014 02:06:49 -0400