After installing updates to address CVE-2014-0160 (the OpenSSL Heartbleed bug), I had to take care to restart anything that might be using libssl -- many services, such as Apache and my VPN software, still had the old vulnerable libssl loaded up, and my package manager made no attempt to rectify this.
This got me thinking: After I update a shared library, how can I reliably find out which running programs currently have an old version of the library linked in? I am sure there must be a way to interrogate running processes either at the linker level or at the file descriptors level to determine whether the instance of a given shared library they have loaded is the same as the one currently on disk.