CVE-2018-6331 Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code execution. This issue affects Buck versio...
CriticalCVSS 9.8
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code execution. This issue affects Buck versions prior to v2018.06.25.01.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| facebook buck | < 2018.06.25.01 | 2018.06.25.01 |
| facebook buck | = v2018.06.25.01 | No fix listed |
| facebook buck | <= v2018.06.25.01 | No fix listed |
References
- github.com patch third-party-advisory