dpsexec (DPS Server) when running under XDM in IBM AIX 3.2.5 and earlier does not properly check privileges, which allows local users to overwrite arbitrary files and gain privileges.

AIX Licensed Program Product performance tools allow local users to gain root access.

AIX bugfiler program allows local users to gain root access.

Buffer overflow in AIX lquerylv program gives root access to local users.

Local user gains root privileges via buffer overflow in rdist, via expstr() function.