pg and pb in SuSE pbpg 1.x package allows an malicious user to read arbitrary files.
suse suse linux 6.2
bent bagger pbpg 1.1
redhat linux 6.0