Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2003-0645: man-db lets local users gain higher privileges

CVE-2003-0645 · published 23 years ago

Summary

Versions 2.3.12 and 2.3.18 through 2.4.1 of man-db read user‑controlled settings from the ~/.manpath file even when the program is running with elevated rights. This can let a local user trick the program into executing actions as a more powerful account. Upgrade to a newer release or disable the setuid behaviour and ensure the ~/.manpath file cannot be tampered with.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
andries_brouwer	man	2.3.20 2.4.1 `cpe:2.3:a:andries_brouwer:man:2.3.20:::::::*`

Original advisory text

man-db 2.3.12 and 2.3.18 to 2.4.1 uses certain user-controlled DEFINE directives from the ~/.manpath file, even when running setuid, which could allow local users to gain privileges.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.6 Medium

Exploitation

<1% chance of attack within 30 days

Timeline

Published27 Aug 2003

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2003-0645 · NVD

Track software like this

Free during beta