vpop3d program in linuxconf 1.23r and previous versions allows local users to overwrite arbitrary files via a symlink attack.
immunix immunix 7.0_beta
redhat linux 7.0