The NeXT NetInfo _writers property allows local users to gain root privileges or conduct a denial of service.

Buffer overflow of rlogin program using TERM environmental variable.

Buffer overflow in lpr, as used in BSD-based systems including Linux, allows local users to execute arbitrary code as root via a l

pcnfsd (aka rpc.pcnfsd) allows local users to change file permissions, or execute arbitrary commands through arguments in the RPC