gzexe in the gzip package on Red Hat Linux 5.0 and earlier allows local users to overwrite files of other users via a symlink attack on a temporary file.
http://www.securityfocus.com/bid/7845
http://www.redhat.com/support/errata/rh50-errata-general.html#gzip
http://www.iss.net/security_center/static/7241.php