NView / XNView multimedia viewer / browser privilege escalation

Dynamic libraries from current directory are loaded on startup...

VMWare virtual machine privilege escalation

Dynamic libraries are searched in world writable directory...