Man-db includes a tool used to build an index of the manual pages installed on a system. The package has been fixed in version 2.3.16-3. See the Source Message for upgrade details.
Some information is provided about which versions are vulnerable and which have been fixed.
Debian has released a fix. This makes it possible for an attacked to do a standard symlink attack to trick mandb into overwriting any file that is writable by uid man, which includes the man and mandb binaries. If you use suidmanager you can also use that to make sure man and mandb are not installed suid which protects you from this problem. Of course even when using suidmanager an upgrade is still strongly recommended. Potato was released for alpha, arm, i386, m68k, powerpc and sparc.