Buffer overflow of rlogin program using TERM environmental variable.

The NeXT NetInfo writers property allows local users to gain root privileges or conduct a denial of service.

Buffer overflow in lpr, as used in BSD-based systems including Linux, allows local users to execute arbitrary code as root via a long -C (classification) command line option.

pcnfsd (aka rpc.pcnfsd) allows local users to change file permissions, or execute arbitrary commands through arguments in the RPC call.