The f2 shell script in the f2c package 3.1 allows local users to read arbitrary files via a symlink attack on temporary files.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2005-0019
http://www.securityfocus.com/bid/12380
http://www.debian.org/security/2005/dsa-661
http://securitytracker.com/id?1013028