CVE-2018-6331

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code execution. This issue affects Buck versions prior to v2018.06.25.01.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
FacebookBuckv2018.06.25.01; >= unspecified, <= v2018.06.25.01

References

Timeline

Published
Dec 31, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-63325.9A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to spend disproportionate CVE-2018-63339.8The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a maliciCVE-2018-63349.8Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not declared explicitly CVE-2018-63357.5A Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data. This behavior can lead to denial-of-service. TCVE-2018-63367.8An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing CVE-2018-63377.5folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked childCVE-2018-63399.8When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in. An offCVE-2018-63408.1The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires control over memcached CVE-2018-63416.1React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That CVE-2018-63429.8react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editoCVE-2018-63437.5Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsiCVE-2018-63447.5A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is established. The vulnerability can be used