gpm-root in the gpm package does not properly drop privileges, which allows local users to gain privileges by starting a utility from gpm-root.

Buffer overflow in mhshow in the Linux nmh package allows remote attackers to execute commands via malformed MIME headers in an email message.

Buffer overflow in the dump utility in the Linux ext2fs backup package allows local users to gain privileges via a long command line argument.

Buffer overflow in ircII 4.4 IRC client allows remote attackers to execute commands via the DCC chat capability.

Red Hat userhelper program in the usermode package allows local users to gain root access via PAM and a .. (dot dot) attack.

Majordomo wrapper allows local users to gain privileges by specifying an alternate configuration file.

resend command in Majordomo allows local users to gain privileges via shell metacharacters.

The initscripts package in Red Hat Linux allows local users to gain privileges via a symlink attack.

cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.

Red Hat Linux screen program does not use Unix98 ptys, allowing local users to write to other terminals.

Buffer overflow in NFS server on Linux allows attackers to execute commands via a long pathname.

Denial of service in Linux syslogd via a large number of connections.

Denial of service in Linux 2.2.x kernels via malformed ICMP packets containing unusual types, codes, and IP header lengths.

The Guile plugin for the Gnumeric spreadsheet package allows attackers to execute arbitrary code.

The Squid package in Red Hat Linux 5.2 and 6.0, and other distributions, installs cachemgr.cgi in a public web directory, which allows remote attackers to use it as an intermediary to connect to other systems.

OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls.

manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.