[R4] SecurityCenter 5.0.0.1 Affected by Third-party Library

SecurityCenter is potentially impacted by several vulnerabilities in PHP that were recently disclosed and fixed. Note that due to the time involved in doing a full analysis of each issue, Tenable has opted to patch the included version of PHP as a precaution, and to save time. CVE-2015-4025: PHP Multiple NULL Byte Injection Filter Bypass WeaknessesCVE-2015-4024: PHP main/rfc1867.c multipart_buffer_headers() Function HTTP Request Multipart/form-data Handling CPU Exhaustion Remote DoS CVE-2015-2326: Perl-Compatible Regular Expression (PCRE) pcre_compile2() Function Regex Handling Heap Buffer Overflow CVE-2015-2325: Perl-Compatible Regular Expression (PCRE) compile_branch() Function Regex Handling Heap Buffer Overflow CVE-2006-7243: PHP Pathname \0 Character file_exists Function Access Restriction Bypass Additionally. the latest version of PHP fix the following issues, but Tenable SecurityCenter is not affected: CVE-2015-3307: PHP ext/phar/phar.c phar_parse_metadata() Function TAR File Parsing Memory Corruption CVE-2015-4022: PHP ext/ftp/ftp.c ftp_genlist() Function Integer Overflow Heap Buffer Overflow CVE-2015-4021: PHP ext/phar/tar.c phar_parse_tarfile() Zero-length Entry Filename Handling Memory Corruption CVE-2015-4026: PHP pcntl_exec() Function NULL Byte Injection Filter Bypass Weakness Please note that Tenable strongly recommends that SecurityCenter be installed on a subnet that is not Internet addressable.