An integer signedness error in FIFO filesystems (named pipes) on Sun Solaris 8 through 10 allows local users to read the contents of unspecified memory locations via a negative value to the I_PEEK ioctl.
http://www.securiteam.com/exploits/5QP0J0KNPK.html
