No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
Credit: Subnet Solutions Inc
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2024-45490 | CWE-611 Improper Restriction of XML External Entity Reference | 9.8 Critical |
An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer. Mitigation: Subnet Solutions inc. reports that dependencies have been updated and vulnerabilities are to be addressed in PowerSYSTEM Center 2020 Update 23 release. Mitigation: Subnet Solutions inc. strongly recommends users update to the latest version. If this is not possible, the following mitigations have been identified: Mitigation: Apply application allow-listing to prevent unauthorized executables from running. Affected, fixed & timelineAffected:
Mitigation: Ensure Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) are enabled within the operating system. Memory protection controls can be enabled via Windows Security. Please refer to this article for reference. |
| CVE-2024-45491 | CWE-190 Integer Overflow or Wraparound | 9.8 Critical |
An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX). Mitigation: Subnet Solutions inc. reports that dependencies have been updated and vulnerabilities are to be addressed in PowerSYSTEM Center 2020 Update 23 release. Mitigation: Subnet Solutions inc. strongly recommends users update to the latest version. If this is not possible, the following mitigations have been identified: Mitigation: Apply application allow-listing to prevent unauthorized executables from running. Affected, fixed & timelineAffected:
Mitigation: Ensure Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) are enabled within the operating system. Memory protection controls can be enabled via Windows Security. Please refer to this article for reference. |
| CVE-2024-45492 | CWE-190 Integer Overflow or Wraparound | 9.8 Critical |
An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). Mitigation: Subnet Solutions inc. reports that dependencies have been updated and vulnerabilities are to be addressed in PowerSYSTEM Center 2020 Update 23 release. Mitigation: Subnet Solutions inc. strongly recommends users update to the latest version. If this is not possible, the following mitigations have been identified: Mitigation: Apply application allow-listing to prevent unauthorized executables from running. Affected, fixed & timelineAffected:
Mitigation: Ensure Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) are enabled within the operating system. Memory protection controls can be enabled via Windows Security. Please refer to this article for reference. |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2024-45490 | 9.8 Critical | n/a n/a An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer. |
| CVE-2024-45491 | 7.3 High | n/a n/a An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT… |
| CVE-2024-45492 | 7.3 High | n/a n/a An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (wh… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.