p PatchFirst

CVE-2024-39684

CVE-2024-39684 · Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer Overflow

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Tencent RapidJSON is vulnerable to privilege escalation due to an integer overflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer overflow vulnerability (when the file is parsed), leading to elevation of privilege.

CVSS 6.8 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • rapidjson

    Versions
    • <= 1.1.0: Affected

    No fix published

  • rapidjson Debian:12

    Versions
    • 1.1.0+dfsg2-7.1
    • 1.1.0+dfsg2-7.2
    • 1.1.0+dfsg2-7.3
    • 1.1.0+dfsg2-7.4
    • 1.1.0+dfsg2-7.6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rapidjson Debian:13

    Versions
    • 1.1.0+dfsg2-7.4
    • 1.1.0+dfsg2-7.6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rapidjson Debian:14

    Versions
    • 1.1.0+dfsg2-7.4
    • 1.1.0+dfsg2-7.6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rapidjson Ubuntu:Pro:16.04:LTS

    Versions
    • 0.12~git20141031-3
    • 0.12~git20141031-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 0.12~git20141031-3ubuntu0.1~esm2

    Update to 0.12~git20141031-3ubuntu0.1~esm2

  • rapidjson Ubuntu:Pro:18.04:LTS

    Versions
    • 0.12~git20141031+dfsg-1
    • 1.1.0+dfsg2-3
    • 1.1.0+dfsg2-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1.1.0+dfsg2-3ubuntu0.1~esm2

    Update to 1.1.0+dfsg2-3ubuntu0.1~esm2

  • rapidjson Ubuntu:Pro:20.04:LTS

    Versions
    • 1.1.0+dfsg2-5
    • 1.1.0+dfsg2-5ubuntu1
    • 1.1.0+dfsg2-5ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: < 1.1.0+dfsg2-5ubuntu1+esm2

    Update to 1.1.0+dfsg2-5ubuntu1+esm2

  • rapidjson Ubuntu:Pro:22.04:LTS

    Versions
    • 1.1.0+dfsg2-7
    • 1.1.0+dfsg2-7ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1.1.0+dfsg2-7ubuntu0.1~esm2

    Update to 1.1.0+dfsg2-7ubuntu0.1~esm2

  • rapidjson Ubuntu:Pro:24.04:LTS

    Versions
    • 1.1.0+dfsg2-7.1
    • 1.1.0+dfsg2-7.2
    • 1.1.0+dfsg2-7.2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1.1.0+dfsg2-7.2ubuntu0.1~esm2

    Update to 1.1.0+dfsg2-7.2ubuntu0.1~esm2

  • rapidjson Ubuntu:25.10

    Versions
    • 1.1.0+dfsg2-7.3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rapidjson Ubuntu:26.10

    Versions
    • 1.1.0+dfsg2-7.6ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rapidjson Ubuntu:26.04:LTS

    Versions
    • 1.1.0+dfsg2-7.3ubuntu1
    • 1.1.0+dfsg2-7.6ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →