These issues allow any user with local system access to cause any files owned by any other user, including root, to potentially be overwritten if the conditions were right.
A recent security fix to cron introduced a new problem with giving up privileges before invoking the editor. A malicious local user could exploit this to gain root acces.
Any user can visit a ZClass declaration and change the ZClass permission mappings for methods and other objects defined within the ZClass, possibly allowing for unauthorized access within the Zope instance.
To browse through our weekly Linux Advisory Watch newsletters,