Race condition in Linux mailx command allows local users to read user files.
Buffer overflow in Linux splitvt command gives root access to local users.
vhe_u_mnt program in HP-UX allows local users to create root files through symlinks.
rpc.ypupdated (NIS) allows remote users to execute arbitrary commands.