# CVE-1999-0032: BSD and Linux lpr buffer overflow in classification option

Source: https://junglewise.ai/threats/cve-1999-0032-bsd-and-linux-lpr-buffer-overflow-in-classification-option  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1996-10-25. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0032 · Severity: high · CVSS 7.2 · Published 1996-10-25

A vulnerability exists in the standard printing utility (lpr) used by many Unix-like operating systems, including Linux and BSD. This flaw allows a person who already has basic access to a computer to gain full administrative control (root access). By exploiting this, an unauthorized user could read sensitive files, modify system settings, or disrupt operations.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Bsd](https://junglewise.ai/threats/vendors/bsd), [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-1999-0032 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0032 being exploited in the wild.

**How severe is CVE-1999-0032?** High severity, with a CVSS score of 7.2, published 25 October 1996.

**Which products and versions are affected?** BSD-based systems All versions using vulnerable lpr; Linux Kernel All versions using vulnerable lpr.

**Is there a fix for CVE-1999-0032?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0032 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-0032?** Check whether you run BSD-based systems or Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The lpr utility contains a classic buffer overflow vulnerability within its command-line argument processing. Specifically, the utility fails to perform adequate bounds checking on the string provided to the '-C' (classification) flag. Because lpr is typically installed with setuid root permissions to manage printer spooling, a local attacker can provide a specially crafted, overly long string to overflow the stack buffer and redirect execution flow. This allows for arbitrary code execution with the effective user ID of root, leading to a full local privilege escalation.

## Affected products

- BSD BSD-based systems All versions using vulnerable lpr
- Linux Linux Kernel All versions using vulnerable lpr

## Timeline

- 1996-10-25: disclosed: Initial publication date in NVD

## References

- [http://www.ciac.org/ciac/bulletins/i-042.shtml](http://www.ciac.org/ciac/bulletins/i-042.shtml)
- [http://www.securityfocus.com/bid/707](http://www.securityfocus.com/bid/707)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)