Debian Linux Security Advisory 2007-1 – Ronald Volgers discovered that the lppasswd component of the cups suite, the Common UNIX Printing System, is vulnerable to format string attacks due to insecure use of the LOCALEDIR environment variable. An attacker can abuse this behaviour to execute arbitrary code via crafted localization files and triggering calls to _cupsLangprintf(). This works as the lppasswd binary happens to be installed with setuid 0 permissions.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/86899/dsa-2007-1.txt
Source: https://packetstormsecurity.com/files/86899/Debian-Linux-Security-Advisory-2007-1.html