At the very least, I think we should upgrade to the latest OpenSSL 0.9.8. I think it's been suggested before to stick it in CSSU Testing but I don't know if anything came of it. As for POODLE mitigation in MicroB, disabling SSL3 via about:config ought to be enough and would be a lot less work than upgrading the browser engine (although a browser engine upgrade and newer OpenSSL would be very welcome).

A security audit is a very good idea. I've been meaning to run a vulnerability scanner such as OpenVAS or Nessus against Fremantle for some time now but I've never gotten around to doing it. It'd be great if someone would post the scan results here.