Buffer overflows in xp_freedll, DROP DATABASE, DBCC CHECKVERIFY.
vulners.com/securityvulns/securityvulns:doc:3820
vulners.com/securityvulns/securityvulns:doc:3821
vulners.com/securityvulns/securityvulns:doc:3822