CVE-2009-4235 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4235): acpid 1.0.4 sets an unrestrictive umask, which might allow local users to leverage weak permissions on /var/log/acpid, and obtain sensitive information by reading this file or cause a denial of service by overwriting this file, a different vulnerability than CVE-2009-4033.
upon further investigation, because of CVE-2009-4033, I found this: http://rhn.redhat.com/errata/RHSA-2009-1642.html: Comment #4 From Tomas Hoger 2009-12-01 10:02:52 EDT ------- Marc Deslauriers pointed out that missing mode argument in /dev/null open call is not from upstream 1.0.4 source, but rather a change from Red Hat patch acpid-1.0.4-fd.patch. So closing invalid.