pg and pb in SuSE pbpg 1.x package allows an malicious user to read arbitrary files.
bent bagger pbpg 1.1
redhat linux 6.0
suse suse linux 6.2