ping in Solaris 2.3 through 2.6 allows local users to cause a denial of service (crash) via a ping request to a multicast address through the loopback interface, e.g. via ping -i.

Solaris syslogd crashes when receiving a message from a host that doesn't have an inverse DNS entry.

Expreserve, as used in vi and ex, allows local users to overwrite arbitrary files and gain root access.

pcnfsd (aka rpc.pcnfsd) allows local users to change file permissions, or execute arbitrary commands through arguments in the RPC call.