Skip to content
OpenAdvisories
Medium USN-7125-1 1 CVE

rapidjson vulnerability

Published Nov 25, 2024 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that RapidJSON incorrectly parsed numbers written in
scientific notation, leading to an integer underflow. An attacker could
possibly use this issue to cause a denial of service, or execute arbitrary
code.

Fixed packages 5

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS rapidjson 0.12~git20141031-3ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS rapidjson 1.1.0+dfsg2-3ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS rapidjson 1.1.0+dfsg2-5ubuntu1+esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS rapidjson 1.1.0+dfsg2-7ubuntu0.1~esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS rapidjson 1.1.0+dfsg2-7.2ubuntu0.1~esm1

Vulnerabilities 1

  • Medium 6.8
    CVE-2024-38517

    Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer Underflow

    Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which …

    Tencent RapidJSON ceph opencc Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2024-38517