lame buffer overflow exists with the -P command line argument for the man program, which is apparently installed set-gid "man".
Please be a bit more specific - I don't see an overflow there. -P uses my_strdup, which allocates exactly as much space as it needs. Feel free to re-open this bug if you thing I'm wrong.