CVE-2003-0645

Description

man-db 2.3.12 and 2.3.18 to 2.4.1 uses certain user-controlled DEFINE directives from the ~/.manpath file, even when running setuid, which could allow local users to gain privileges.

Affected products

• andries_brouwer / man2.3.20 – 2.3.20
• andries_brouwer / man2.4.1 – 2.4.1

References

• MISChttp://www.securityfocus.com/bid/8352
• MAILING_LISThttp://marc.info/?l=bugtraq&m=106018504800341&w=2
• MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/12848
• VENDOR_ADVISORYhttp://www.debian.org/security/2003/dsa-364