Buffer overflow in TTSESSION environment variable in ToolTalk shared library allows local users to gain root privileges.
HP CDE program includes the current directory in root's PATH variable.
The suidperl and sperl program do not give up root privileges when changing UIDs back to the original users, allowing root access.