Buffer overflow of rlogin program using TERM environmental variable.

Telnet allows a remote client to specify environment variables including LD_LIBRARY_PATH, allowing an attacker to bypass the normal system libraries and gain root access.

Oversized ICMP ping packets can result in a denial of service, aka Ping o' Death.

Buffer overflow and denial of service in Sendmail 8.7.5 and earlier through GECOS field gives root access to local users.

The suidperl and sperl program do not give up root privileges when changing UIDs back to the original users, allowing root access.

Remote attackers can mount an NFS file system in Ultrix or OSF, even if it is denied on the access list.

Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames.

Digital Unix 4.0 has a buffer overflow in the inc program of the mh package.

Digital Unix Networker program nsralist has a buffer overflow which allows local users to obtain root privilege.

ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service.

The ToolTalk ttsession daemon uses weak RPC authentication, which allows a remote attacker to execute commands.

Buffer overflow in the AddSuLog function of the CDE dtaction utility allows local users to gain root privileges via a long user name.

The dtlogin program in Compaq Tru64 UNIX allows local users to gain root privileges.

Vulnerability in Compaq Tru64 UNIX edauth command.

Vulnerability in LAT/Telnet Gateway (lattelnet) on Ultrix 4.1 and 4.2 allows attackers to gain root privileges.

Vulnerability in Advanced File System Utility (advfs) in Digital UNIX 4.0 through 4.0d allows local users to gain privileges.

VMS 4.0 through 5.3 allows local users to gain privileges via the ANALYZE/PROCESS_DUMP dcl command.

dxconsole in DEC OSF/1 3.2C and earlier allows local users to read arbitrary files by specifying the file with the -file parameter.

chroot in Digital Ultrix 4.1 and 4.0 is insecurely installed, which allows local users to gain privileges.

xterm in Digital UNIX 4.0B *with* patch kit 5 allows local users to overwrite arbitrary files via a symlink attack on a core dump file, which is created when xterm is called with a DISPLAY environmental variable set to a display that xterm cannot access.