The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3537