Looks like apache2-common 2.0.43-1 is in testing, and a slightly higher version in unstable. The question then becomes...are there any extra genuflections I need to go through to keep apache2 secure, since the Security Team won't? Or is the rule, "if it ain't in apt, proceed as normal"?

Re: Java. I meant 1.4.

So I think I'll go "testing", as long as that doesn't wreck anything else, which I don't believe it will. :)