The cancel command in Solaris 2.6 (i386) has a buffer overflow that allows local users to obtain root access.
CVSS Metrics
