The kernel in Sun Solaris 10 and 11 snv101b, and OpenSolaris before snv108, allows remote attackers to cause a denial of service (system crash) via a crafted IPv6 packet, related to an "insufficient validation security vulnerability," as demonstrated by SunOSipv6.c.

Unspecified vulnerability in Kerberos Incremental Propagation in Solaris 10 and OpenSolaris snv01 through snv110 allows remote attackers to cause a denial of service (loss of incremental propagation requests to slave KDC servers) via unknown vectors related to the master Key Distribution Center (KDC) server.

Unspecified vulnerability in the TCP/IP networking stack in Sun Solaris 10, and OpenSolaris snv01 through snv82 and snv111 through snv117, when a Cassini GigaSwift Ethernet Adapter (aka CE) interface is used, allows remote attackers to cause a denial of service (panic) via vectors involving jumbo frames.

tun in IP Tunnel in Solaris 10 and OpenSolaris snv01 through snv76 allows local users to cause a denial of service (panic) and possibly execute arbitrary code via a crafted SIOCGTUNPARAM IOCTL request, which triggers a NULL pointer dereference.

Stack-based buffer overflow in the consoptions function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.