Race condition in the dircmp script in Sun Solaris 8 through 10, and OpenSolaris snv01 through snv111, allows local users to overwrite arbitrary files, probably involving a symlink attack on temporary files.
Unspecified vulnerability in Sun OpenSolaris snv100 through snv101 allows local users, with privileges in a non-global zone, to execute arbitrary code in the global zone when a global-zone user is using mdb on a non-global zone process.
Unspecified vulnerability in Kerberos Incremental Propagation in Solaris 10 and OpenSolaris snv01 through snv110 allows remote attackers to cause a denial of service (loss of incremental propagation requests to slave KDC servers) via unknown vectors related to the master Key Distribution Center (KDC) server.
Unspecified vulnerability in the keysock kernel module in Solaris 10 and OpenSolaris builds snv01 through snv108 allows local users to cause a denial of service (system panic) via unknown vectors related to PFKEY socket, probably related to setting socket options.
The NFS server in Sun Solaris 10, and OpenSolaris before snv111, does not properly implement the AUTHNONE (aka sec=none) security mode in combination with other security modes, which allows remote attackers to bypass intended access restrictions and read or modify files, as demonstrated by a combination of the AUTHNONE and AUTHSYS security modes.
The NFSv4 Server module in the kernel in Sun Solaris 10, and OpenSolaris before snv111, allow local users to cause a denial of service (infinite loop and system hang) by accessing an hsfs filesystem that is shared through NFSv4, related to the rfs4opreaddir function.
The crypto pseudo device driver in Sun Solaris 10, and OpenSolaris snv88 through snv102, does not properly free memory, which allows local users to cause a denial of service (panic) via unspecified vectors, related to the vmemhashdelete function.
Unspecified vulnerability in the process (aka proc) filesystem in Sun OpenSolaris snv85 through snv100 allows local users to gain privileges via vectors related to the contract filesystem.
The IP-in-IP packet processing implementation in the IPsec and IP stacks in the kernel in Sun Solaris 9 and 10, and OpenSolaris snv01 though snv85, allows local users to cause a denial of service (panic) via a self-encapsulated packet that lacks IPsec protection.
Unspecified vulnerability in the autofs module in the kernel in Sun Solaris 8 through 10, and OpenSolaris before snv108, allows local users to cause a denial of service (autofs mount outage) or possibly gain privileges via vectors related to "xdr processing problems."
The kernel in Sun Solaris 10 and 11 snv101b, and OpenSolaris before snv108, allows remote attackers to cause a denial of service (system crash) via a crafted IPv6 packet, related to an "insufficient validation security vulnerability," as demonstrated by SunOSipv6.c.
Unspecified vulnerability in the kernel in OpenSolaris snv100 through snv102 on the Sun UltraSPARC T2 and T2+ sun4v platforms allows local users to cause a denial of service (panic) via unknown vectors.
Race condition in the pseudo-terminal (aka pty) driver module in Sun Solaris 8 through 10, and OpenSolaris before snv103, allows local users to cause a denial of service (panic) via unspecified vectors related to lack of "properly sequenced code" in ptc and ptsl.
Unspecified vulnerability in lpadmin in Sun Solaris 10 and OpenSolaris snv61 through snv106 allows local users to cause a denial of service via unspecified vectors, related to enumeration of "wrong printers," aka a "Temporary file vulnerability."
Unspecified vulnerability in ppdmgr in Sun Solaris 10 and OpenSolaris snv61 through snv106 allows local users to cause a denial of service via unspecified vectors, related to a failure to "include all cache files," and improper handling of temporary files.
Unspecified vulnerability in the nfs4renamepersistentfh function in the NFS 4 (aka NFSv4) client in the kernel in Sun Solaris 10 and OpenSolaris before snv102 allows local users to cause a denial of service (recursive mutexenter and panic) via unspecified vectors.
The name service cache daemon (nscd) in Sun Solaris 10 and OpenSolaris snv50 through snv104 does not properly check permissions, which allows local users to gain privileges and obtain sensitive information via unspecified vectors.
The Kerberos credential renewal feature in Sun Solaris 8, 9, and 10, and OpenSolaris build snv01 through snv104, allows local users to cause a denial of service (authentication failure) via unspecified vectors related to incorrect cache file permissions, and lack of credential storage by the storecred function in pamkrb5.
tun in IP Tunnel in Solaris 10 and OpenSolaris snv01 through snv76 allows local users to cause a denial of service (panic) and possibly execute arbitrary code via a crafted SIOCGTUNPARAM IOCTL request, which triggers a NULL pointer dereference.
The default configuration of Oracle OpenSolaris snv91 through snv131 allows attackers to have an unspecified impact via vectors related to using kclient to join a Windows Active Directory domain.
The default configuration of Oracle OpenSolaris snv77 through snv131 allows attackers to have an unspecified impact via vectors related to using smbadm to join a Windows Active Directory domain.
Unspecified vulnerability in Sun Solaris 10 and OpenSolaris snv49 through snv117, when 64bit mode is used on the Intel x86 platform and a Linux (lx) branded zone is configured, allows local users to cause a denial of service (panic) via unspecified vectors, a different vulnerability than CVE-2007-6225.
The ucodeioctl function in intel/io/ucodedrv.c in Sun Solaris 10 and OpenSolaris snv69 through snv133, when running on x86 architectures, allows local users to cause a denial of service (panic) via a request with a 0 size value to the UCODEGETVERSION IOCTL, which triggers a NULL pointer dereference in the ucodegetrev function, related to retrieval of the microcode revision.
Unspecified vulnerability in the ZFS filesystem in Sun Solaris 10, and OpenSolaris snv100 through snv117, allows local users to bypass intended limitations of the filechownself privilege via certain uses of the chown system call.
Stack-based buffer overflow in the consoptions function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.
Memory leak in the Ultra-SPARC T2 crypto provider device driver (aka n2cp) in Sun Solaris 10, and OpenSolaris snv54 through snv112, allows context-dependent attackers to cause a denial of service (memory consumption) via unspecified vectors related to a large keylen value.
Multiple race conditions in the Solaris Event Port API in Sun Solaris 10 and OpenSolaris before snv107 allow local users to cause a denial of service (panic) via unspecified vectors related to a race between the portdissociate and close functions.
smbfs in Sun OpenSolaris snv84 through snv110, when default mount permissions are used, allows local users to read arbitrary files, and list arbitrary directories, on CIFS volumes.
Unspecified vulnerability in idmap in Sun OpenSolaris snv88 through snv110, when a CIFS server is enabled, allows local users to cause a denial of service (idpmapd daemon crash and idmapd outage) via unknown vectors.
Unspecified vulnerability in rpc.nisd in Sun Solaris 8 through 10, and OpenSolaris before snv104, allows remote authenticated users to cause a denial of service (NIS+ daemon hang) via unspecified vectors related to NIS+ callbacks.