SunOS 4.1.2 and earlier allows local users to gain privileges via "LD_*" environmental variables to certain dynamically linked setuid or setgid programs such as (1) login, (2) su, or (3) sendmail, that change the real and effective user ids to the same user.

Buffer overflow in uum program for Canna input system allows local users to gain root privileges.

Solaris 2.6 HW3/98 installs admintool with world-writable permissions, which allows local users to gain privileges by replacing it with a Trojan horse program.

Buffer overflow in Solaris lpstat via class argument allows local users to gain root access.

Buffer overflow in CDE mailtool allows local users to gain root privileges via a long MIME Content-Type.

The Sun Web-Based Enterprise Management (WBEM) installation script stores a password in plaintext in a world readable file.

Buffer overflow in Solaris libc, ufsrestore, and rcp via LC_MESSAGES environmental variable.

The CDE dtspcd daemon allows local users to execute arbitrary commands via a symlink attack.

The BSD profil system call allows a local user to modify the internal data space of a program via profiling and execve.

ucbmail allows remote attackers to execute commands via shell metacharacters that are passed to it from INN.

The cancel command in Solaris 2.6 (i386) has a buffer overflow that allows local users to obtain root access.

Vulnerability in in.telnetd in SunOS 4.1.1 and earlier allows local users to gain root privileges.

Buffer overflow in Solaris getopt in libc allows local users to gain root privileges via a long argv[0].

Solaris volrmmount program allows attackers to read any file.

Buffer overflow in lpr, as used in BSD-based systems including Linux, allows local users to execute arbitrary code as root via a long -C (classification) command line option.

vold in Solaris 2.x allows local users to gain root access.

Solaris sysdef command allows local users to read kernel memory, potentially leading to root privileges.

Certain NFS servers allow users to use mknod to gain privileges by creating a writable kmem device and setting the UID to 0.

Buffer overflow in Solaris kcms_configure command allows local users to gain root access.

Buffer overflow in Solaris x86 mkcookie allows local users to obtain root access.

The WorkMan program can be used to overwrite any file to get root access.

Buffer overflow in Solaris fdformat command gives root access to local users.

Local user gains root privileges via buffer overflow in rdist, via expstr() function.

Buffer overflow in xlock program allows local users to execute commands as root.

Buffer overflow in Xt library of X Windowing System allows local users to execute commands with root privileges.

Buffer overflow in the libauth library in Solaris allows local users to gain additional privileges, possibly root access.

The Sun sdtcm_convert calendar utility for OpenWindows has a buffer overflow which can gain root access.

Command execution in Sun systems via buffer overflow in the at program.

Buffer overflow in ffbconfig in Solaris 2.5.1.

Buffer overflow in SunOS/Solaris ps command.

In Solaris 2.2 and 2.3, when fsck fails on startup, it allows a local user with physical access to obtain root access.

Arbitrary file creation and program execution using FLEXlm LicenseManager, from versions 4.0 to 5.0, in IRIX.

Buffer overflow in Sun's ping program can give root access to local users.

Kodak Color Management System (KCMS) on Solaris allows a local user to write to arbitrary files and gain root access.

Solaris ufsrestore buffer overflow.

Buffer overflow in the format command in Solaris 8, 9, and 10 allows local users with access to format (such as the "File System Management" RBAC profile) to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2006-4307.

Unspecified vulnerability in clsetup in the configuration utility in Sun Solaris Cluster 3.2 allows local users to gain privileges via unknown vectors.

Unknown multiple vulnerabilities in (1) lpstat and (2) the libprint library in Solaris 2.6 through 9 may allow attackers to execute arbitrary code or read or write arbitrary files.

Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Power Management.

The runtime linker (ld.so) in Solaris 8, 9, and 10 trusts the LD_AUDIT environment variable in setuid or setgid programs, which allows local users to gain privileges by (1) modifying LD_AUDIT to reference malicious code and possibly (2) using a long value for LD_AUDIT.

Buffer overflow in utmp_update for Solaris 2.6 through 9 allows local users to gain root privileges, as identified by Sun BugID 4705891, a different vulnerability than CVE-2003-1068.

Heap-based buffer overflow in dtsession for Solaris 2.5.1 through Solaris 9 allows local users to gain root privileges via a long HOME environment variable.

Directory traversal vulnerability in priocntl system call in Solaris does allows local users to execute arbitrary code via ".." sequences in the pc_clname field of a pcinfo_t structure, which cause priocntl to load a malicious kernel module.

Buffer overflow in Xsun on Solaris 2.6 through 8 allows local users to gain root privileges via a long -co (color database) command line argument.

Buffer overflow in ptexec in the Sun Validation Test Suite 4.3 and earlier allows a local user to gain privileges via a long -o argument.

Heap overflow in xlock in Solaris 2.6 through 8 allows local users to gain root privileges via a long (1) XFILESEARCHPATH or (2) XUSERFILESEARCHPATH environmental variable.

Buffer overflow in whodo in Solaris SunOS 5.5.1 through 5.8 allows local users to execute arbitrary code via a long (1) SOR or (2) CFIME environment variable.

Buffer overflow in exrecover in Solaris 2.6 and earlier possibly allows local users to gain privileges via a long command line argument.

Buffer overflow in /usr/bin/cu in Solaris 2.8 and earlier, and possibly other operating systems, allows local users to gain privileges by executing cu with a long program name (arg0).

Heap overflow in savestr function in LBNL traceroute 1.4a5 and earlier allows a local user to execute arbitrary commands via the -g option.