The default configuration in mate-settings-daemon 1.5.3 allows local users to change the timezone for the system via a crafted D-Bus call.
mate-desktop mate-settings-daemon 1.5.3