pear-XML_RPC -- remote PHP code injection vulnerability

A Hardened-PHP Project Security Advisory reports:

When the library parses XMLRPC requests/responses, it constructs
a string of PHP code, that is later evaluated. This means any
failure to properly handle the construction of this string can
result in arbitrary execution of PHP code.
This new injection vulnerability is cause by not properly
handling the situation, when certain XML tags are nested
in the parsed document, that were never meant to be nested
at all. This can be easily exploited in a way, that
user-input is placed outside of string delimiters within
the evaluation string, which obviously results in
arbitrary code execution.

Note that several applications contains an embedded version
on XML_RPC, therefor making them the vulnerable to the same
code injection vulnerability.