xpdf PDF viewer client earlier than 0.91 allows local users to overwrite arbitrary files via a symlink attack.
xpdf xpdf 0.90