CVE-2003-0124

man before 1.5l allows attackers to execute arbitrary code via a malformed man file with improper quotes, which causes the my_xsprintf function to return a string with the value "unsafe," which is then executed as a program via a system call if it is in the search path of the user who runs man.

CVSS v2.0

4.6 MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P

EPSS

1.51% chance of exploitation in the next 30 days, 73th percentile

Published

2004-09-01

Updated

2024-08-08

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/22344

References

• CVE Record
• NVD entry

Related

• CVE-2003-0121
• CVE-2003-0125
• CVE-2003-0118
• CVE-2003-0127
• CVE-2003-0117
• CVE-2003-0128