Gentoo Linux Security Advisory GLSA 200510-21 – Stefan Esser discovered that by calling certain PHP files directly, it was possible to workaround the grab_globals.lib.php security model and overwrite the $cfg configuration array. Systems running PHP in safe mode are not affected. Furthermore, Tobias Klein reported several cross-site-scripting issues resulting from insufficient user input sanitizing. Versions less than 2.6.4_p3 are affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/40960/glsa-200510-21.txt
Source: https://packetstormsecurity.com/files/40960/Gentoo-Linux-Security-Advisory-200510-21.html