Critical
Security advisory
Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code execution. This issue affects Buck versions prior to v2018.06.25.01.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-6331
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:26 UTC · Revision 1
Source evidence
Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code execution. This issue affects Buck versions prior to v2018.06.25.01.
osv:CVE-2018-6331
Complete source record
{
"id": "d873972a1a9bf043602a3b087cd37c330a8c312dec82cae69aadbabdeb7ac3b7",
"url": "https://osv.dev/vulnerability/CVE-2018-6331",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-6331",
"summary": "Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code execution. This issue affects Buck versions prior to v2018.06.25.01.",
"evidence": "osv:CVE-2018-6331",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2018-6331",
"aliases": [
"CVE-2018-6331"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/facebook/buck",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "266d085873781fdf00f1419444a7ba8976b8084d"
},
{
"fixed": "8c5500981812564877bd122c0f8fab48d3528ddf"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:facebook:buck:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2018.06.25.01"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "8c5500981812564877bd122c0f8fab48d3528ddf"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v2018.03.26.01",
"v2018.02.16.01",
"v2017.11.16.01",
"v2017.10.01.01",
"v2017.09.04.01",
"v2017.09.04.02",
"v2017.05.31.01",
"v2017.05.09.01",
"v2017.03.29.01",
"v2015.09.15.01",
"v2015.09.10.01"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-6331.json",
"vanir_signatures": [
{
"id": "CVE-2018-6331-5a157d8e",
"digest": {
"length": 1446,
"function_hash": "134644099577632656356301366235559859540"
},
"source": "https://github.com/facebook/buck/commit/8c5500981812564877bd122c0f8fab48d3528ddf",
"target": {
"file": "src/com/facebook/buck/cli/ParserCacheCommand.java",
"function": "runWithoutHelp"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-6331-6b900ab8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"294908862540740728211718966180692737441",
"139875312924700524251988940463570794877",
"210487957749746909939118443453884109758",
"329906905120647623747116729497957191862",
"143532120316266836751838371556411848009",
"99937910495947498223997628691234419861",
"41957212922945413548730296476111818066",
"212526429110154489961712439064715026927",
"11503067880287711469757032956378510177",
"41284443922876524147709528125234617249",
"213435899883661749969395760996239759309",
"145166166893495046052026498987737677774",
"37041542446811250621202090507626639301",
"321871189578994292621772302711838567073",
"284448606779553295816869817515816000305"
]
},
"source": "https://github.com/facebook/buck/commit/8c5500981812564877bd122c0f8fab48d3528ddf",
"target": {
"file": "test/com/facebook/buck/cli/ParserCacheCommandIntegrationTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-6331-de0bb0d9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327907603331701235201862311636604267077",
"208399489611775618888646420564319829987",
"49829991717620061785605041251447117388",
"311121164583708823896600424447241207651",
"338096795697352815717481467254715727923",
"92587449257307688904441480635600292602"
]
},
"source": "https://github.com/facebook/buck/commit/8c5500981812564877bd122c0f8fab48d3528ddf",
"target": {
"file": "src/com/facebook/buck/cli/ParserCacheCommand.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:35:02Z"
}
}
],
"modified": "2026-10-20T13:35:02.224203222Z",
"provider": "osv",
"references": [
"https://github.com/facebook/buck/commit/8c5500981812564877bd122c0f8fab48d3528ddf"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2018-6331",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387840,
"published_at": "2018-12-31T23:29:00.237+00:00"
}