HP-UX aserver program allows local users to gain privileges via a symlink attack.

Buffer overflow and denial of service in Sendmail 8.7.5 and earlier through GECOS field gives root access to local users.

Local users can start Sendmail in daemon mode and gain root privileges.

Buffer overflow in xlock program allows local users to execute commands as root.

Buffer overflow in Xt library of X Windowing System allows local users to execute commands with root privileges.

Unauthorized privileged access or denial of service via dtappgather program in CDE.

Buffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query.

CDE ToolTalk database server (ttdbserver) allows remote attackers to overwrite arbitrary memory locations with a zero, and possibly gain privileges, via a file descriptor argument in an AUTHUNIX procedure call, which is used as a table index by the TTISCLOSE procedure.

CDE ToolTalk database server (ttdbserver) allows local users to overwrite arbitrary files via a symlink attack on the transaction log file used by the TTTRANSACTION RPC procedure.

Stack-based buffer overflow in the FTP daemon in HP-UX 11.11i, with the -v (debug) option enabled, allows remote attackers to execute arbitrary code via a long command request.