Unknown vulnerability in NFS on Solaris 2.5.1 through Solaris 9 allows an NFS client to cause a denial of service by killing the lockd daemon.

Buffer overflow in mailx in Solaris 8 and earlier allows a local attacker to gain additional privileges via a long '-F' command line option.

The dynamic linker in Solaris allows a local user to create arbitrary files via the LDPROFILE environmental variable and a symlink attack.

sdtcmconvert in Solaris 2.6 allows a local user to overwrite sensitive files via a symlink attack.

In Sun Solaris and SunOS, man and catman contain vulnerabilities that allow overwriting arbitrary files.

Sun's ftpd daemon can be subjected to a denial of service.

Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames.

Denial of Service vulnerability in BIND 8 Releases via maliciously formatted DNS messages.

Denial of Service vulnerabilities in BIND 4.9 and BIND 8 Releases via CNAME record and zone transfer.

Buffer overflow in SGI IRIX mailx program.

ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service.

DNS cache poisoning via BIND, by predictable query IDs.

Oversized ICMP ping packets can result in a denial of service, aka Ping o' Death.

Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file.

Delete or create a file via rpc.statd, due to invalid information.