The make include files in NetBSD before 1.6.2, as used in pmake 1.111 and other products, allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_depend##### temporary file, related to (1) bsd.lib.mk and (2) bsd.prog.mk.
Exploitability
AV:LAC:MAu:NImpact
C:NI:PA:P3.3/AV:L/AC:M/Au:N/C:N/I:P/A:P