Solaris 2.4 before kernel jumbo patch -35 allows set-gid programs to dump core even if the real user id is not in the set-gid group, which allows local users to overwrite or create files at higher privileges by causing a core dump, e.g. through dmesg.

The dynamic linker in Solaris allows a local user to create arbitrary files via the LDPROFILE environmental variable and a symlink attack.

ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service.

In Sun Solaris and SunOS, man and catman contain vulnerabilities that allow overwriting arbitrary files.

Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames.

Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file.

Buffer overflow in SGI IRIX mailx program.

Sun's ftpd daemon can be subjected to a denial of service.

DNS cache poisoning via BIND, by predictable query IDs.