Buffer overflow in dtmail in Solaris 2.6 and 7 allows local users to gain privileges via the MAIL environment variable.
- http://marc.info/?l=bugtraq&m=99598918914068&w=2
No PoCs found on GitHub currently.