The emacspeak package as shipped with Red Hat Enterprise Linux 3, 4 and 5
and as shipped within Fedora releases 8, 9 and 10 is prone to the symlink
attack.

Affected file: /usr/share/emacs/site-lisp/emacspeak/etc/extract-table.pl

Relevant part of the code:

 44 my $output = new FileHandle (">  /tmp/$task.csv");
 45 my ($ts,$row);
 46 foreach $ts ($te->table_states) {
 47           foreach $row ($ts->rows) {
 48              $output->print ( join(',', @$row), "\n");
 49           }
 50         }
 51 
 52 $output->close();


Explanation:

A malicious user could precreate a symlink pointing to the file /tmp/extract-table.csv, then run the 'emacspeak' command with such
a syntax, that would call the 'extract-table.pl' script. This could
allow him to destroy the target of the symlink.

References:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496374 (part for emacspeak)