An attacker with more computational power than all legitimate Bitcoin miners can, given enough time, reverse any Bitcoin transaction after the latest checkpoint. Executing this attack is generally believed to be very unprofitable, since an attacker this powerful would be noticed as soon as he reversed any transactions, and all potentially-vulnerable sites would shut down until the attacker lost control. The Bitcoin developers could even reverse the attacker's damage in some cases by hard-coding some transaction ordering info into the client (though doing this would be controversial).
Attackers with less computational power than the rest of the network can still succeed in reversing transactions, though their success isn't guaranteed. Reversing a two-confirmation transaction, for example, requires solving three blocks before the rest of the network solves one. A miner who solves one-fourth of all blocks on average can do this with probability ~1/64. Whenever the attacker fails to create the three blocks necessary, he will lose any blocks he created in the double-spend attempt, so attempting this attack is often unprofitable.
Reversing a 1-confirmation transaction requires mining only two blocks in row, which can be profitable against certain targets with only around 5% of the network's computational power. With 5% of the network, the attacker has a 5% chance of solving the first necessary block and a 5% chance of solving the next block and succeeding in the double-spend. The attacker only risks losing a block while mining the second block, so his real odds of losing a block instead of reversing the transaction is 95% -- not too bad in some cases. This was MyBitcoin's excuse for how they lost customer money (which may or may not be true, though it is possible).
0-confirmation transactions can be reversed by solving only one block, and sometimes without solving any blocks. They should be treated as being nearly as reversible as credit card payments.