Untrusted search path vulnerability in Lhasa 0.19 and earlier allows local users to gain privileges via a Trojan horse executable file in the current working directory.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-2379
http://www.ipa.go.jp/about/press/20101012_2.html