If no further information is known, you should expect that an attacker can read all your memory. See the heartbleed challenge from Cloudflare as an example. They set up a webserver with a vulnerable version of OpenSSL. Some hours later several persons extracted the key. Fedor Indutny described his work. From his description you can see that he could read random parts of the servers memory. So you should assume that an attacker can read all your memory when you use a vulnerable OpenSSL version.
Furthermore the heartbleed page which was set up by one of the people who found the vulnerability writes:
Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.
When OpenSSL allocates memory it takes an area which is not in use by other processes. You can find old data in there and read this out. However the process isolation takes care that a process can't read data from other processes.