Esound, the Gnome sound server, contains a race condition that a malicious user could exploit to change permissions of any file owned by the esound user.
Esound, the sound daemon used for Gnome, creates a world-writable directory, /tmp/.esd. This directory is owned by the user running esound, and is used to store a socket which is used by programs connecting to the sound server. During startup, this socket's permissions are adjusted. An attacker on the system can theoretically create a symbolic link, and cause any file or directory owned by the user running esound to be made world writable. The new packages fixes this race condition.