CVE-2003-0124: Andries Brouwer Man

Medium severity, CVSS 4.6. EPSS: 1.5% chance of exploitation in the next 30 days.

man before 1.5l allows attackers to execute arbitrary code via a malformed man file with improper quotes, which causes the my_xsprintf function to return a string with the value "unsafe," which is then executed as a program via a system call if it is in the search path of the user who runs man.

Affected products

• Andries Brouwer Man: version 1.5h1 only; version 1.5i only; version 1.5i2 only; version 1.5j only; version 1.5k only

Published 2003-03-18. Last modified 2026-06-16.