Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the GenericReader::ParseNumber() function of include/rapidjson/reader.h when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer underflow vulnerability (when the file is parsed), leading to elevation of privilege.
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Rapidjson | Ubuntu | esm-apps/bionic | * |
| Rapidjson | Ubuntu | esm-apps/focal | * |
| Rapidjson | Ubuntu | esm-apps/jammy | * |
| Rapidjson | Ubuntu | esm-apps/noble | * |
| Rapidjson | Ubuntu | esm-apps/xenial | * |
| Rapidjson | Ubuntu | mantic | * |
| Rapidjson | Ubuntu | oracular | * |