Переполнения буфера в atcronsh, auditsh, authsh, backupsh, lpsh, sysadm.menu, termsh.
vulners.com/securityvulns/securityvulns:doc:2089