| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Buffer overflow in xmcd 2.0p12 allows local users to gain access through an environmental variable. |
| Buffer overflow in Solaris fdformat command gives root access to local users. |
| A race condition in the Solaris ps command allows an attacker to overwrite critical files. |
| Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames. |
| SunOS/Solaris FTP clients can be forced to execute arbitrary commands from a malicious FTP server. |
| Kerberos 4 key servers allow a user to masquerade as another by breaking and generating session keys. |
| Buffer overflow in Sun's ping program can give root access to local users. |
| Local user gains root privileges via buffer overflow in rdist, via expstr() function. |
| Buffer overflow in NIS+, in Sun's rpc.nisd program. |
| Kodak Color Management System (KCMS) on Solaris allows a local user to write to arbitrary files and gain root access. |
| Buffer overflow in SunOS/Solaris ps command. |
| Buffer overflows in Sun libnsl allow root access. |
| CDE screen lock program (screenlock) on Solaris 2.6 does not properly lock an unprivileged user's console session when the host is an NIS+ client, which allows others with physical access to login with any string. |
| useradd in Solaris 7.0 does not properly interpret certain date formats as specified in the "-e" (expiration date) argument, which could allow users to login after their accounts have expired. |
| rmmount in SunOS 5.7 may mount file systems without the nosuid flag set, contrary to the documentation and its use in previous versions of SunOS, which could allow local users with physical access to gain root privileges by mounting a floppy or CD-ROM that contains a setuid program and running volcheck, when the file systems do not have the nosuid option specified in rmmount.conf. |
| lpr on SunOS 4.1.1, BSD 4.3, A/UX 2.0.1, and other BSD-based operating systems allows local users to create or overwrite arbitrary files via a symlink attack that is triggered after invoking lpr 1000 times. |
| Vulnerability in restore in SunOS 4.0.3 and earlier allows local users to gain privileges. |
| The permissions for the /dev/audio device on Solaris 2.2 and earlier, and SunOS 4.1.x, allow any local user to read from the device, which could be used by an attacker to monitor conversations happening near a machine that has a microphone. |
| SunOS 4.1.2 and earlier allows local users to gain privileges via "LD_*" environmental variables to certain dynamically linked setuid or setgid programs such as (1) login, (2) su, or (3) sendmail, that change the real and effective user ids to the same user. |
| nis_cachemgr for Solaris NIS+ allows attackers to add malicious NIS+ servers. |
