Heartbleed was a memory leak that eventually, after carefully calculated exploiting, can lead to a remote root.

Shellshock depends on a lot of environmental details, but is possible little more than a hard to reach shell with elevated permissions.

I guess heartbleed was actually worse. Who runs webscripts and stuff in root? That's really foolhardy. But using OpenSSL ... We usually thought it good practice!