Fedora 25: php-pear-PHP-CodeSniffer Critical: Arbitrary Code Execution

PHP_CodeSniffer provides functionality to verify that code conforms to

certain standards, such as PEAR, or user-defined.

**Version 2.8.1** * This release contains a fix for a security advisory related to the improper handling of shell commands * Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases * A properly crafted filename or configuration option would allow for arbitrary code execution when using some features * All users are encouraged to upgrade to this version, especially if you are checking 3rd-party code * e.g., you run PHPCS over libraries that you did not write * e.g., you provide a web service that runs PHPCS over user-uploaded files or 3rd-party repositories * e.g., you allow external tool paths to be set by user-defined values * If you are unable to upgrade but you check 3rd-party code, ensure you are not using the following features: * The diff report * The notify-send report * The Generic.PHP.Syntax sniff * The Generic.Debug.CSSLint sniff * The Generic.Debug.Closure...