Buffer overflow in Solaris lpstat via class argument allows local users to gain root access.
sun sunos 5.7
sun solaris 2.6