The PHP package in Slackware 8.1 9.0 and 9.1 when linked against a static library includes /tmp in the search path which allows local users to execute arbitrary code as the PHP user by inserting shared libraries into the appropriate path.