Skip to content
OpenAdvisories
Critical · 9.8 CVE-2018-6331 EUVD-2018-18092GHSA-gwvw-v6hg-775r

Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it…

Published Dec 31, 2018 · Updated May 6, 2025 · Assigned by facebook

Vendor: Facebook Product: Buck

Description

Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code execution. This issue affects Buck versions prior to v2018.06.25.01.

Affected products

VendorProductAffectedFixed
Facebook Buck v2018.06.25.01, unspecified – ≤ v2018.06.25.01 —

References