runlpr in the LPRng package allows the local lp user to gain root privileges via certain command line arguments.
NVD-CWE-Other