Security Vulnerability in all PEAR versions prior to 1.4.3 discovered

As noted in the official announcement at http://pear.php.net/advisory-20051104.txt, a security vulnerability has been discovered in all existing PEAR versions (that's right: PEAR 1.0 through PEAR 1.4.2) prior to today's release of PEAR 1.4.3. The vulnerability was discovered entirely by accident (it literally occurred to me while thinking about PEAR as I was getting ready for work on Monday morning). Although the risk of an exploit through this vulnerability is low, the vulnerability itself is quite severe, as it allows a malicious developer to execute arbitrary PHP code on your machine if you install an evil package.

If you are running an older version of PEAR, you need to upgrade as soon as possible. Full details of the vulnerability will be published in a few weeks.

Incidentally, an oversight removed PHP 4.2.x compatibility, which is fixed in PEAR 1.4.4