CVE-2018-6331

State: Published
Severity: 9.8 Critical
Published: Dec 31, 2018
Updated: May 6, 2025
Reserved: Jan 26, 2018

Description

Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code execution. This issue affects Buck versions prior to v2018.06.25.01.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-502 Deserialization of Untrusted Data (CWE-502)

Affected Products

Product	Versions
BuckFacebook	v2018.06.25.01Affected v2018.06.25.01 and earlierAffected

References

https://github.com/facebook/buck/commit/8c5500981812564877bd122c0f8fab48d3528ddf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.