Mandriva Linux Security Update Advisory – A flaw was discovered in mod_ssl’s handling of the SSLVerifyClient directive. This flaw occurs if a virtual host is configured using SSLVerifyClient optional and a directive SSLVerifyClient required is set for a specific location. For servers configured in this fashion, an attacker may be able to access resources that should otherwise be protected, by not supplying a client certificate when connecting. A flaw was discovered in Apache httpd where the byterange filter would buffer certain responses into memory. If a server has a dynamic resource such as a CGI script or PHP script that generates a large amount of data, an attacker could send carefully crafted requests in order to consume resources, potentially leading to a Denial of Service.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/39983/MDKSA-2005-161.txt
Source: https://packetstormsecurity.com/files/39983/Mandriva-Linux-Security-Advisory-2005.161.html