
CVE-2005-0988
https://notcve.org/view.php?id=CVE-2005-0988
06 Apr 2005 — Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete. • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.58/SCOSA-2005.58.txt •

CVE-2001-0169 – GLIBC 2.1.3 - 'LD_PRELOAD' Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2001-0169
26 Mar 2001 — When using the LD_PRELOAD environmental variable in SUID or SGID applications, glibc does not verify that preloaded libraries in /etc/ld.so.cache are also SUID/SGID, which could allow a local user to overwrite arbitrary files by loading a library from /lib or /usr/lib. • https://www.exploit-db.com/exploits/290 •

CVE-2000-0844 – Immunix OS 6.2 - LC glibc format string
https://notcve.org/view.php?id=CVE-2000-0844
14 Nov 2000 — Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execute arbitrary commands via functions such as gettext and catopen. • https://www.exploit-db.com/exploits/20187 • CWE-264: Permissions, Privileges, and Access Controls •

CVE-2000-0438 – S.u.S.E Linux 4.x/5.x/6.x/7.0 / Slackware 3.x/4.0 / Turbolinux 6 / OpenLinux 7.0 - 'fdmount' Local Buffer Overflow
https://notcve.org/view.php?id=CVE-2000-0438
22 May 2000 — Buffer overflow in fdmount on Linux systems allows local users in the "floppy" group to execute arbitrary commands via a long mountpoint parameter. • https://www.exploit-db.com/exploits/19952 •

CVE-2000-0336 – OpenLDAP 1.2.7/1.2.8/1.2.9/1.2.10 - '/usr/tmp/' Symlink
https://notcve.org/view.php?id=CVE-2000-0336
21 Apr 2000 — Linux OpenLDAP server allows local users to modify arbitrary files via a symlink attack. • https://www.exploit-db.com/exploits/19946 •

CVE-2000-0172 – Matt Kimball and Roger Wolff mtr 0.28/0.41 / Turbolinux 3.5 b2/4.2/4.4/6.0 - mtr
https://notcve.org/view.php?id=CVE-2000-0172
03 Mar 2000 — The mtr program only uses a seteuid call when attempting to drop privileges, which could allow local users to gain root privileges. • https://www.exploit-db.com/exploits/19796 •

CVE-2000-0186
https://notcve.org/view.php?id=CVE-2000-0186
28 Feb 2000 — Buffer overflow in the dump utility in the Linux ext2fs backup package allows local users to gain privileges via a long command line argument. • http://www.redhat.com/support/errata/RHSA-2000-100.html •

CVE-2000-0196
https://notcve.org/view.php?id=CVE-2000-0196
28 Feb 2000 — Buffer overflow in mhshow in the Linux nmh package allows remote attackers to execute commands via malformed MIME headers in an email message. • http://www.redhat.com/support/errata/RHSA-2000-006.html •

CVE-2000-0170 – RedHat 6.1 - 'man' Local Overflow / Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2000-0170
26 Feb 2000 — Buffer overflow in the man program in Linux allows local users to gain privileges via the MANPAGER environmental variable. • https://www.exploit-db.com/exploits/255 •

CVE-2000-0052 – Mandrake 6.x / RedHat 6.x / Turbolinux 3.5 b2/4.x/6.0.2 userhelper/PAM - Path
https://notcve.org/view.php?id=CVE-2000-0052
04 Jan 2000 — Red Hat userhelper program in the usermode package allows local users to gain root access via PAM and a .. (dot dot) attack. • https://www.exploit-db.com/exploits/19709 •