Unknown vulnerability in UDP RPC for Solaris 2.5.1 through 9 for SPARC, and 2.5.1 through 8 for x86, allows remote attackers to cause a denial of service (memory consumption) via certain arguments in RPC calls that cause large amounts of memory to be allocated.
Directory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcmsserver) allows remote attackers to read arbitrary files via the KCSOPENPROFILE procedure.
Unknown vulnerability in the System Serial Console terminal in Solaris 2.5.1, 2.6, and 7 allows local users to monitor keystrokes and possibly steal sensitive information.
Denial of service in Solaris TCP streams driver via a malicious connection that causes the server to panic as a result of recursive calls to mutexenter.
The dynamic linker in Solaris allows a local user to create arbitrary files via the LDPROFILE environmental variable and a symlink attack.
sdtcmconvert in Solaris 2.6 allows a local user to overwrite sensitive files via a symlink attack.
ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service.
In Sun Solaris and SunOS, man and catman contain vulnerabilities that allow overwriting arbitrary files.
Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file.
Buffer overflow in SGI IRIX mailx program.
Sun's ftpd daemon can be subjected to a denial of service.
DNS cache poisoning via BIND, by predictable query IDs.
VERITAS File System (VxFS) 3.3.3, 3.4, and 3.5 before MP1 Rolling Patch 02 for Sun Solaris 2.5.1 through 9 does not properly implement inheritance of default ACLs in certain circumstances related to the characteristics of a directory inode, which allows local users to bypass intended file permissions by accessing a file on a VxFS filesystem.
Buffer overflow in mailx in Solaris 8 and earlier allows a local attacker to gain additional privileges via a long '-F' command line option.
Unknown vulnerability in NFS on Solaris 2.5.1 through Solaris 9 allows an NFS client to cause a denial of service by killing the lockd daemon.