Skip to content
OpenAdvisories
Medium · 6.8 CVE-2024-39684 EUVD-2024-38186

Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer Overflow

Published Jul 9, 2024 · Updated Sep 5, 2024 · Assigned by GitHub_M

Description

Tencent RapidJSON is vulnerable to privilege escalation due to an integer overflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer overflow vulnerability (when the file is parsed), leading to elevation of privilege.

Affected products

VendorProductAffectedFixed
Tencent RapidJSON <= 1.1.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 rapidjson No fix yet —
Debian 13 rapidjson No fix yet —
Debian 12 rapidjson No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 rapidjson No fix yet —
Ubuntu 25.10 rapidjson No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS rapidjson 1.1.0+dfsg2-7.2ubuntu0.1~esm2 —
Ubuntu Pro 22.04 LTS rapidjson 1.1.0+dfsg2-7ubuntu0.1~esm2 —
Ubuntu Pro 20.04 LTS rapidjson 1.1.0+dfsg2-5ubuntu1+esm2 —
Ubuntu Pro 18.04 LTS rapidjson 1.1.0+dfsg2-3ubuntu0.1~esm2 —
Ubuntu Pro 16.04 LTS rapidjson 0.12~git20141031-3ubuntu0.1~esm2 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 opencc No fix yet —
Azure Linux 3 rapidjson 1.1.0-8 —
Azure Linux 2 (CBL-Mariner) ceph 16.2.10-5 —
Azure Linux 2 (CBL-Mariner) opencc No fix yet —
Azure Linux 2 (CBL-Mariner) rapidjson 1.1.0-8 —

Advisories 3

References