I believe the specific change was to remove this line of C in two places

            MD_Update(&m,buf,j);

And the reason it was a security bug is that in one of those two places the variable buf has the precious entropy we wanted in it and so now we're not really getting random numbers.