CVE-2003-0124

man before 1.5l allows attackers to execute arbitrary code via a malformed man file with improper quotes, which causes the my_xsprintf function to return a string with the value "unsafe," which is then executed as a program via a system call if it is in the search path of the user who runs man.

CVSS v2.0 NVD

4.6 MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P

EPSS

1.51% chance of exploitation in the next 30 days, 74th percentile

Published

2004-09-01

Updated

2024-08-08

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/22344

Security advisories

• http://www.securityfocus.com/bid/7066
• http://www.redhat.com/support/errata/RHSA-2003-133.html
• http://www.redhat.com/support/errata/RHSA-2003-134.html

References

• CVE Record
• NVD entry