Linux cdwtools 093 and previous versions allows local users to gain root privileges via the /tmp directory.
suse suse linux 6.2
suse suse linux 6.1