"able to steal the SSL certificate, to be sure, and also able to intercept other HTTPS connections"
Couldn't a SSL-terminating process that's vulnerable to heartbleed also leak unencrypted traffic? The attacker wouldn't even need to be in a position to intercept other users' connections, which is much worse.
I don't know about stunnel specifically though, maybe it doesn't free memory containing unencrypted traffic.
The worse problem is that once you get the private key you can MITM the traffic or, if forward security was not used, decrypt a sniffed one -- this will limit the casual attacker to a directed attacks, though.
Couldn't a SSL-terminating process that's vulnerable to heartbleed also leak unencrypted traffic? The attacker wouldn't even need to be in a position to intercept other users' connections, which is much worse.
I don't know about stunnel specifically though, maybe it doesn't free memory containing unencrypted traffic.