Ubuntu Security Notice USN-207-1 – A bug has been found in the handling of the open_basedir directive handling. Contrary to the specification, the value of open_basedir was handled as a prefix instead of a proper directory name even if it was terminated by a slash (‘/’). For example, this allowed PHP scripts to access the directory /home/user10 when open_basedir was configured to ‘/home/user1/’.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/40777/usn-207-1.txt
Source: https://packetstormsecurity.com/files/40777/usn-207-1.txt.html