Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2024-39684
Good to know:
Date: July 9, 2024
Tencent RapidJSON is vulnerable to privilege escalation due to an integer overflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer overflow vulnerability (when the file is parsed), leading to elevation of privilege.
Language: C++
Severity Score
Severity Score
Weakness Type (CWE)
Integer Overflow or Wraparound
CWE-190Top Fix
Upgrade Version
Upgrade to version rsc_osrm - 0.1.25;rsc_osrm - 0.1.31;rsc_osrm - 0.1.47;rsc_osrm - 0.1.14;tencent.rapidjson - no_fix;rapidjson.v110 - no_fix;rapidjson - no_fix;vowpalwabbit-sys - no_fix;StoneSteps.RapidJSON.VS2022.Static - no_fix;rs_osrm_serde - no_fix;rapidjson - 1.1.0.post20240409;Bond.Sources - no_fix;rustcord-sys - 0.2.4;rs_osrm - no_fix;opencc-sys - no_fix
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | LOCAL |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | REQUIRED |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | HIGH |
| Integrity (I): | HIGH |
| Availability (A): | HIGH |