PT-2018-17481 · Facebook · Buck

Published 2018-12-31 · Updated 2025-05-06 · CVE-2018-6331

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Buck versions prior to v2018.06.25.01

Description The issue arises from the Buck parser-cache command, which utilizes Java serialized objects to load and save state. If the state information is maliciously crafted, deserializing it could lead to code execution.

Recommendations For versions prior to v2018.06.25.01, update to version v2018.06.25.01 or later to resolve the issue.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2018-6331

Affected Products

Buck

References · 4

• https://github.com/facebook/buck/commit/8c5500981812564877bd122c0f8fab48d3528ddf · Patch
• https://osv.dev/vulnerability/CVE-2018-6331 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6331 · Security Note
• https://t.me/cvenotify/121021 · Telegram Post