CVE-2018-3745 Out-of-bounds Read in atob
The atob library allocates uninitialized buffers when handling numeric inputs, potentially allowing attackers to execute code or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-3745?
CVE-2018-3745 is a critical memory corruption vulnerability in HackerOne atob node module, published on 29 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
atob 2.0.3 and earlier allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.
Weakness: CWE-125
Which versions are affected by CVE-2018-3745?
2 open source packages ship an affected version, including atob. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
atob npm | All versions | 2.1.0 |
atob npm | All versions | 2.1.0 |
Products include Atob Project Atob.
How do I fix CVE-2018-3745?
Upgrade atob to 2.1.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2018-3745 being exploited?
There is no known exploitation of CVE-2018-3745 in the wild and no public exploit code.
Sources
Also known as CVE-2018-3742, GHSA-8w4h-3cm3-2pm2.