p PatchFirst

CVE-2024-38517

CVE-2024-38517 · Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer Underflow

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer underflow vulnerability (when the file is parsed), leading to elevation of privilege.

CVSS 6.8 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • rapidjson

    Versions
    • <= 1.1.0: Affected

    No fix published

  • rapidjson Debian:12

    Versions
    • 1.1.0+dfsg2-7.1
    • 1.1.0+dfsg2-7.2
    • 1.1.0+dfsg2-7.3
    • 1.1.0+dfsg2-7.4
    • 1.1.0+dfsg2-7.6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rapidjson Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.1.0+dfsg2-7.4

    Update to 1.1.0+dfsg2-7.4

  • rapidjson Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.1.0+dfsg2-7.4

    Update to 1.1.0+dfsg2-7.4

  • rapidjson Ubuntu:Pro:16.04:LTS

    Versions
    • 0.12~git20141031-3
    Affected ranges
    • ECOSYSTEM: < 0.12~git20141031-3ubuntu0.1~esm1

    Update to 0.12~git20141031-3ubuntu0.1~esm1

  • rapidjson Ubuntu:Pro:18.04:LTS

    Versions
    • 0.12~git20141031+dfsg-1
    • 1.1.0+dfsg2-3
    Affected ranges
    • ECOSYSTEM: < 1.1.0+dfsg2-3ubuntu0.1~esm1

    Update to 1.1.0+dfsg2-3ubuntu0.1~esm1

  • rapidjson Ubuntu:Pro:20.04:LTS

    Versions
    • 1.1.0+dfsg2-5
    • 1.1.0+dfsg2-5ubuntu1
    Affected ranges
    • ECOSYSTEM: < 1.1.0+dfsg2-5ubuntu1+esm1

    Update to 1.1.0+dfsg2-5ubuntu1+esm1

  • rapidjson Ubuntu:Pro:22.04:LTS

    Versions
    • 1.1.0+dfsg2-7
    Affected ranges
    • ECOSYSTEM: < 1.1.0+dfsg2-7ubuntu0.1~esm1

    Update to 1.1.0+dfsg2-7ubuntu0.1~esm1

  • rapidjson Ubuntu:Pro:24.04:LTS

    Versions
    • 1.1.0+dfsg2-7.1
    • 1.1.0+dfsg2-7.2
    Affected ranges
    • ECOSYSTEM: < 1.1.0+dfsg2-7.2ubuntu0.1~esm1

    Update to 1.1.0+dfsg2-7.2ubuntu0.1~esm1

Original sources

Check your server →