Secunia

A vulnerability has been reported in PEAR, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to a design error in the PEAR installer. This can be exploited by a package that is installed using the PEAR installer to execute arbitrary PHP code when the "pear" command is executed or the Web/Gtk frontend is loaded.

Successful exploitation requires that the user has installed a malicious package using the PEAR installer, or installed a package that depends on a malicious package.

The vulnerability has been reported in version 1.4.2 and prior.

Solution
Update to version 1.4.3 or later.
Further details available in Customer Area

Provided and/or discovered by
Reported by vendor.

Original Advisory
http://pear.php.net/advisory-20051104.txt

Deep Links
Links available in Customer Area