Buffer overflow in Solaris lpstat via class argument allows local users to gain root access.
sun solaris 2.6
sun sunos 5.7