PT-2024-5552 · Tencent+4 · Rapidjson+4

Fmalita · Published 2024-06-18 · Updated 2024-12-03 · CVE-2024-38517

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tencent RapidJSON (affected versions not specified)

Description The issue is related to an integer underflow in the GenericReader::ParseNumber() function of include/rapidjson/reader.h when parsing JSON text from a stream. This can be exploited by an attacker sending a crafted file to the victim, which when opened, triggers the integer underflow vulnerability, leading to elevation of privilege. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Integer Underflow

Integer Overflow

Weakness Enumeration

CWE-191

CWE-190

Related Identifiers

AZL-43245

AZL-43300

AZL-43320

AZL-43543

AZL-45330

BDU:2024-06231

CVE-2024-38517

MGASA-2024-0371

OESA-2024-1857

USN-7125-1

Affected Products

Debian

Linuxmint

Rapidjson

Ubuntu

Windows

References · 39

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38517.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-38517 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-45330 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/709886 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38517 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38517 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43543 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7125-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-38517 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1857 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38517 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-38517 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-38517 · Security Note
• https://osv.dev/vulnerability/USN-7125-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43300 · Vendor Advisory