A certain Debian patch for txt2man 1.5.5, as used in txt2man 1.5.5-2, 1.5.5-4, and others, allows local users to overwrite arbitrary files via a symlink attack on /tmp/2222.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-1481
http://www.ubuntu.com/usn/USN-1979-1