man before 1.5l allows attackers to execute arbitrary code via a malformed man file with improper quotes, which causes the my_xsprintf function to return a string with the value unsafe, which is then executed as a program via a system call if it is in the search path of the user who runs man.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Man | Andries_brouwer | 1.5h1 (including) | 1.5h1 (including) |
| Man | Andries_brouwer | 1.5i (including) | 1.5i (including) |
| Man | Andries_brouwer | 1.5i2 (including) | 1.5i2 (including) |
| Man | Andries_brouwer | 1.5j (including) | 1.5j (including) |
| Man | Andries_brouwer | 1.5k (including) | 1.5k (including) |