Triggered by a report to Packet Storm  from Virulent, a format
string vulnerability was found in mod_ssl , the Apache SSL/TLS
interface to OpenSSL, version (up to and including) 2.8.18 for Apache
1.3. The mod_ssl in Apache 2.x is not affected. The vulnerability
could be exploitable if Apache is used as a proxy for HTTPS URLs and
the attacker established a own specially prepared DNS and origin
More information here:
We're still investigating if this is actually an issue.
An errata is in progress for this issue, but it a low risk. From the
upcoming advisory text:
"A format string issue was discovered in mod_ssl for Apache 1.3 which
can be triggered if mod_ssl is configured to allow a client to proxy
to remote SSL sites. If mod_ssl is forced to connect to a remote SSL
server using a carefully crafted hostname, an attacker may be able to
crash an Apache child process. This issue is not known to allow
arbitrary execution of code."
An errata has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.