Unknown vulnerability in chroot on SCO UnixWare 7.1.1 through 7.1.4 allows local users to escape the chroot jail and conduct unauthorized activities.
SCO UnixWare 7.1.1, 7.1.3, and Open UNIX 8.0.0 allows local users to bypass protections for the "as" address space file for a process ID (PID) by obtaining a procfs file descriptor for the file and calling execve() on a setuid or setgid program, which leaves the descriptor open to the user.
ISC BIND 8.3.x before 8.3.7, and 8.4.x before 8.4.3, allows remote attackers to poison the cache via a malicious name server that returns negative responses with a large TTL (time-to-live) value.
Buffer overflow in CDE libDtHelp library allows local users to execute arbitrary code via (1) a modified DTHELPUSERSEARCHPATH environment variable and the Help feature, (2) DTSEARCHPATH, or (3) LOGNAME.
Buffer overflow in rpc.cmsd in SCO UnixWare 7.1.1 and Open UNIX 8.0.0 allows remote attackers to execute arbitrary commands via a long parameter to rtablecreate (procedure 21).
ARCserve agent in SCO UnixWare 7.x allows local attackers to gain root privileges via a symlink attack.
Vulnerability in SCO cu program in UnixWare 7.x allows local users to gain privileges.
Vulnerability in the EELS system in SCO UnixWare 7.1.x allows remote attackers to cause a denial of service.
The ARCserve agent in UnixWare allows local attackers to modify arbitrary files via a symlink attack.
UnixWare pkgtrans allows local users to read arbitrary files via a symlink attack.
The SCO UnixWare privileged process system allows local users to gain root privileges by using a debugger such as gdb to insert traps into init before the privileged process is executed.
Buffer overflow in UnixWare xauto program allows local users to gain root privilege.
UnixWare programs that dump core allow a local user to modify files via a symlink attack on the ./core.pid file.
UnixWare uidadmin allows local users to modify arbitrary files via a symlink attack.
main.c in cscope 15-4 and 15-5 creates temporary files with predictable filenames, which allows local users to overwrite arbitrary files via a symlink attack.
The NFS mountd service on SCO UnixWare 7.1.1, 7.1.3, 7.1.4, and 7.0.1, and possibly other versions, when run from inetd, allows remote attackers to cause a denial of service (memory exhaustion) via a series of requests, which causes inetd to launch a separate process for each request.
The X server in SCO UnixWare 7.1.1, 7.1.3, and 7.1.4 does not properly create socket directories in /tmp, which could allow attackers to hijack local sockets.