The default configuration of Oracle OpenSolaris snv77 through snv131 allows attackers to have an unspecified impact via vectors related to using smbadm to join a Windows Active Directory domain.

Memory leak in the Ultra-SPARC T2 crypto provider device driver (aka n2cp) in Sun Solaris 10, and OpenSolaris snv54 through snv112, allows context-dependent attackers to cause a denial of service (memory consumption) via unspecified vectors related to a large keylen value.

Unspecified vulnerability in the TCP/IP networking stack in Sun Solaris 10, and OpenSolaris snv01 through snv82 and snv111 through snv117, when a Cassini GigaSwift Ethernet Adapter (aka CE) interface is used, allows remote attackers to cause a denial of service (panic) via vectors involving jumbo frames.

Unspecified vulnerability in Kerberos Incremental Propagation in Solaris 10 and OpenSolaris snv01 through snv110 allows remote attackers to cause a denial of service (loss of incremental propagation requests to slave KDC servers) via unknown vectors related to the master Key Distribution Center (KDC) server.

The kernel in Sun Solaris 10 and 11 snv101b, and OpenSolaris before snv108, allows remote attackers to cause a denial of service (system crash) via a crafted IPv6 packet, related to an "insufficient validation security vulnerability," as demonstrated by SunOSipv6.c.

Stack-based buffer overflow in the consoptions function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.