man-db 2.3.12 and 2.3.18 to 2.4.1 uses certain user-controlled DEFINE directives from the ~/.manpath file, even when running setuid, which could allow local users to gain privileges.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Man | Andries_brouwer | 2.3.20 | 2.3.20 |
Man | Andries_brouwer | 2.4.1 | 2.4.1 |