PEAR Archive_Tar < 1.4.4 – PHP Object Injection

Source