The zsoelim program in the Debian man-db package allows local users to overwrite files via a symlink attack.