man before 1.5l allows attackers to execute arbitrary code via a malformed man file with improper quotes, which causes the my_xsprintf function to return a string with the value unsafe, which is then executed as a program via a system call if it is in the search path of the user who runs man.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Man | Andries_brouwer | 1.5h1 (including) | 1.5h1 (including) |
| Man | Andries_brouwer | 1.5i (including) | 1.5i (including) |
| Man | Andries_brouwer | 1.5i2 (including) | 1.5i2 (including) |
| Man | Andries_brouwer | 1.5j (including) | 1.5j (including) |
| Man | Andries_brouwer | 1.5k (including) | 1.5k (including) |
| Red Hat Enterprise Linux AS (Advanced Server) version 2.1 | RedHat | * | |
| Red Hat Enterprise Linux ES version 2.1 | RedHat | * | |
| Red Hat Enterprise Linux WS version 2.1 | RedHat | * | |
| Red Hat Linux 7.1 | RedHat | * | |
| Red Hat Linux 7.2 | RedHat | * | |
| Red Hat Linux 7.3 | RedHat | * | |
| Red Hat Linux 8.0 | RedHat | * | |
| Red Hat Linux Advanced Workstation 2.1 | RedHat | * |