xman allows local users to gain privileges by modifying the MANPATH to point to a man page whose filename contains shell metacharacters.
xfree86 project x11r6 3.3.2