Format string vulnerability in man in some Linux distributions allows local users to gain privileges via a malformed -l parameter.
https://exchange.xforce.ibmcloud.com/vulnerabilities/6059
https://euvd.enisa.europa.eu/vulnerability/EUVD-2001-0193
http://www.securityfocus.com/bid/2327