CVE-2018-6331

Published: Dec 31, 2018Modified: Jun 17, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code execution. This issue affects Buck versions prior to v2018.06.25.01.

Affected (1)

Products: Facebook: Buck

Facebook

1 product

Buck

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Facebook Buck	Before 2018.06.25.01

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://github.com/facebook/buck/commit/8c5500981812564877bd122c0f8fab48d3528ddf

Source: cve-assign@fb.com

PatchThird Party Advisory

https://github.com/facebook/buck/commit/8c5500981812564877bd122c0f8fab48d3528ddf

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.