gr_osview in SGI IRIX does not drop privileges before opening files, which allows local users to overwrite arbitrary files via the -s option.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2005-0466
http://www.idefense.com/application/poi/display?id=225&type=vulnerabilities