Buffer overflow in XFree86 3.3.x allows local users to execute arbitrary commands via a long -xkbmap parameter.
xfree86 project x11r6 4.0
xfree86 project x11r6 3.3.6