IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges.

ppl program in HP-UX allows local users to create root files through symlinks.

fpkg2swpk in HP-UX allows local users to gain root access.

HP CDE program includes the current directory in root's PATH variable.

Buffer overflow in SCO UnixWare Xsco command via a long argument.

UnixWare dos7utils allows a local user to gain root privileges by using the STATICMERGE environmental variable to find a script which it executes.

Buffer overflow in HP-UX cstm program allows local users to gain root privileges.

The default configuration for UUCP in AIX before 3.2 allows local users to gain root privileges.

Buffer overflow in chfn command in HP-UX 9.X through 10.20 allows local users to gain privileges via a long command line argument.

Buffer overflow in ping in AIX 4.2 and earlier allows local users to gain root privileges via a long command line argument.

Vulnerability in the /etc/suid_exec program in HP Apollo Domain/OS sr10.2 and sr10.3 beta, related to the Korn Shell (ksh).

UnixWare pkgtrans allows local users to read arbitrary files via a symlink attack.

Buffer overflow in mstm in HP-UX allows local users to gain root access.

Buffer overflow in AIX writesrv command allows local users to obtain root access.

AIX infod allows local users to gain root access through an X display.

Buffer overflows in Sun libnsl allow root access.

Buffer overflow in AIX lquerylv program gives root access to local users.

The suidperl and sperl program do not give up root privileges when changing UIDs back to the original users, allowing root access.

Unauthorized privileged access or denial of service via dtappgather program in CDE.

Local user gains root privileges via buffer overflow in rdist, via expstr() function.

Various vulnerabilities in the AIX portmir command allows local users to obtain root access.

AIX bugfiler program allows local users to gain root access.

Command execution in Sun systems via buffer overflow in the at program.

Buffer overflow in AIX rcp command allows local users to obtain root access.

Local users can start Sendmail in daemon mode and gain root privileges.

Buffer overflow in AIX xdat gives root access to local users.

Buffer overflow and denial of service in Sendmail 8.7.5 and earlier through GECOS field gives root access to local users.

swinstall and swmodify commands in SD-UX package in HP-UX systems allow local users to create or overwrite arbitrary files to gain root access.

Buffer overflow in xlock program allows local users to execute commands as root.

AIX passwd allows local users to gain root access.

AIX nslookup command allows local users to obtain root access by not dropping privileges correctly.

Director Agent 6.1 before 6.1.2.3 in IBM Systems Director on AIX and Linux uses incorrect permissions for the (1) diruninstall and (2) opt/ibm/director/bin/wcitinst scripts, which allows local users to gain privileges by executing these scripts.

Unknown vulnerability in display of Merge before 5.3.23a in UnixWare 7.1.x allows local users to gain root privileges.

Buffer overflow in AIX lchangelv gives root access.

UnixWare programs that dump core allow a local user to modify files via a symlink attack on the ./core.pid file.

Buffer overflow in AIX dtterm program for the CDE.

Buffer overflow in qoslist in bos.net.tcp.server in IBM AIX 6.1 and VIOS 2.1 allows local users to gain privileges via unspecified vectors.

Buffer overflow in Xt library of X Windowing System allows local users to execute commands with root privileges.

Buffer overflow in the Alternate Data Stream (aka ADS or named stream) functionality in the backup-archive client in IBM Tivoli Storage Manager (TSM) before 5.4.3.4, 5.5.x before 5.5.3, 6.x before 6.1.4, and 6.2.x before 6.2.2 on Windows allows local users to gain privileges via unspecified vectors.

Buffer overflow in HPUX passwd command allows local users to gain root privileges via a command line option.

Several startup scripts in SCO OpenServer Enterprise System v 5.0.4p, including S84rpcinit, S95nis, S85tcp, and S89nfs, are vulnerable to a symlink attack, allowing a local user to gain root access.

HP ThinPro 4.4 through 6.1 mishandles the keyboard layout control panel and virtual keyboard application, which allows local users to bypass intended access restrictions and gain privileges via unspecified vectors.

Multiple buffer overflows in qoslist in IBM AIX 6.1 allow local users to cause a denial of service (application crash) or possibly gain privileges via a long string argument. NOTE: some of these details are obtained from third party information.

Multiple buffer overflows in qosmod in IBM AIX 6.1 allow local users to cause a denial of service (application crash) or possibly gain privileges via long string arguments. NOTE: some of these details are obtained from third party information.

Unspecified vulnerability in db2licm in the Engine Utilities component in IBM DB2 9.5 before FP5 has unknown impact and local attack vectors.

gssd in IBM AIX 5.3.x through 5.3.9 and 6.1.0 through 6.1.2 does not properly handle the NFSv4 Kerberos credential cache, which allows local users to bypass intended access restrictions for Kerberized NFSv4 shares via unspecified vectors.

The Install component in IBM DB2 9.5 before FP5 and 9.7 before FP1 configures the High Availability (HA) scripts with incorrect file-permission and authorization settings, which has unknown impact and local attack vectors.

Unspecified vulnerability in HP Data Protector Express, and Data Protector Express Single Server Edition (SSE), 3.x before build 56936 and 4.x before build 56906 on Windows allows local users to gain privileges or cause a denial of service via unknown vectors, a different vulnerability than CVE-2010-3007.

Unspecified vulnerability in Role-Based Access Control (RBAC) in HP HP-UX B.11.23 and B.11.31 allows local users to bypass intended access restrictions via unknown vectors.

The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands.