The dynamic linker in Solaris allows a local user to create arbitrary files via the LDPROFILE environmental variable and a symlink attack.

In Sun Solaris and SunOS, man and catman contain vulnerabilities that allow overwriting arbitrary files.

Sun's ftpd daemon can be subjected to a denial of service.

Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames.

Buffer overflow in SGI IRIX mailx program.

ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service.

DNS cache poisoning via BIND, by predictable query IDs.

Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file.

Solaris 2.4 before kernel jumbo patch -35 allows set-gid programs to dump core even if the real user id is not in the set-gid group, which allows local users to overwrite or create files at higher privileges by causing a core dump, e.g. through dmesg.