CVE-2024-39684: Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer Overflow
Github: CVE-2024-39684 TenCent RapidJSON Elevation of Privilege Vulnerability
Other sources
Tencent RapidJSON is vulnerable to privilege escalation due to an integer overflow in the GenericReader::ParseNumber() function of include/rapidjson/reader.h when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer overflow vulnerability (when the file is parsed), leading to elevation of privilege.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.17763.6054Patch KB5040430 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.14393.7159Patch KB5040434 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.3880Patch KB5040442 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.25398.1009Patch KB5040438 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.10240.20710Patch KB5040448 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22000.3079Patch KB5040431 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19044.4651Patch KB5040427 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19045.4651Patch KB5040427 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22621.3880Patch KB5040442 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.2582Patch KB5040437 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2.9200.24975Patch KB5040485 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.9600.22074Patch KB5040456 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.0.6003.22769Patch KB5040490 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.1.7601.27219Patch KB5040498 - Upgrade
Upgrade
ubuntu/rapidjsonto a version that resolves this vulnerability.Fixed in 0.12~git20141031-3ubuntu0.1~esm2 - Upgrade
Upgrade
ubuntu/rapidjsonto a version that resolves this vulnerability.Fixed in 1.1.0+dfsg2-3ubuntu0.1~esm2 - Upgrade
Upgrade
ubuntu/rapidjsonto a version that resolves this vulnerability.Fixed in 1.1.0+dfsg2-5ubuntu1+esm2 - Upgrade
Upgrade
ubuntu/rapidjsonto a version that resolves this vulnerability.Fixed in 1.1.0+dfsg2-7ubuntu0.1~esm2 - Upgrade
Upgrade
ubuntu/rapidjsonto a version that resolves this vulnerability.Fixed in 1.1.0+dfsg2-7.2ubuntu0.1~esm2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39684?
CVE-2024-39684 has been classified as a privilege escalation vulnerability due to an integer overflow.
How do I fix CVE-2024-39684?
To fix CVE-2024-39684, apply the available patches from Microsoft for affected software versions.
Which software is affected by CVE-2024-39684?
CVE-2024-39684 affects various versions of Microsoft Windows including Windows Server 2016, Windows 10, and Windows 11.
What types of attacks can CVE-2024-39684 facilitate?
CVE-2024-39684 can facilitate privilege escalation attacks, allowing attackers to gain elevated permissions.
When was CVE-2024-39684 reported?
CVE-2024-39684 was reported recently, highlighting a vulnerability in the Tencent RapidJSON library.