Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux does not verify pathnames before installation actions which allows local users to obtain root privileges via a crafted installation file aka Bug ID CSCuv11947.