CVE-2003-0645: Andries Brouwer Man

Medium severity, CVSS 4.6. EPSS: 0.7% chance of exploitation in the next 30 days.

man-db 2.3.12 and 2.3.18 to 2.4.1 uses certain user-controlled DEFINE directives from the ~/.manpath file, even when running setuid, which could allow local users to gain privileges.

Affected products

• Andries Brouwer Man: version 2.3.20 only; version 2.4.1 only

Published 2003-08-27. Last modified 2026-06-16.