...
I fully realize this is a complicated situation. I've tried to lay out the set of steps needed as concisely as I can, but I encourage anybody who's concerned about their system to start by applying the update and then feel free to contact the Shibboleth team using either the mailing list, or if you prefer confidentiality, feel free to use the security reporting form at http://shibboleth.internet2.edu/shib-sec-contact.cfm
We'll be happy to respond and advise as to your particular situation.