The open() function in FreeBSD allows local malicious users to write to arbitrary files.
freebsd freebsd 2.1.0
freebsd freebsd 2.2