Buffer overflow in sar for OpenServer 5.0.5 allows local users to gain root privileges via a long -o parameter.
Buffer overflow in dlvraudit for Caldera OpenServer 5.0.5 and 5.0.6 allows local users to gain root privileges.
scoadmin for Caldera/SCO OpenServer 5.0.5 and 5.0.6 allows local users to overwrite arbitrary files via a symlink attack on temporary files, as demonstrated using log files.