We think we have found a bug in the core CiviCRM related to user permissions.
If we give a role (eg authenticated) only the "CiviCRM: view my contact" permission. They have NO other CiviCRM permissions. Then as that user we go to our CiviCRM contact record (we did this by typing in the path as have provided no way to get there ie http://demo.fuzion.co.nz/civicrm/contact/view?reset=1&cid=230). On that page you get a EDIT button, which allows you to edit your contact details, and you are able to save these changes. I would assume this button should only be available if the role is given the "CiviCRM: edit my contact" permission.
We are on Drupal 7.43 and CiviCRM 4.6.14.
This is not the same issue as https://civicrm.stackexchange.com/questions/7151/permissions-view-my-contact-and-edit-my-contact-do-not-seem-to-work as I checked without the "CiviCRM: view my contact" they get access denied on the page.