As far as I know, the first one is the coinbase transaction
The leaf nodes are in the same order as the transactions in the block. This order is chosen by the miners (other than the coinbase being first).
Please see here for more info: https://bitcoin.stackexchange.com/a/46768/51948
CVE-2012-2459 is detailed here. The relevant fix:
The problem was fixed by Gavin Andresen in Bitcoin commit be8651d  by rejecting blocks with duplicate transactions in CheckBlock, preventing them from being cached at all.
So essentially the Merkle tree itself still has the same issue, but it can never be a problem in practice when used in Bitcoin blocks.