CVE-2008-5352
Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in...
9.3 HighFix available
Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted applications and applets to gain privileges via a Pack200 compressed JAR file that triggers a heap-based buffer overflow.
Exploit likelihood
3.06%Up 0.4 points since Feb 4, 2022
What each source reports
NVD Score used
Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted applications and applets to gain privileges via a Pack200 compressed JAR file that triggers a heap-based buffer overflow.
- Record
CVE-2008-5352- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted applications and applets to gain privileges via a Pack200 compressed JAR file that triggers a heap-based buffer overflow.
- Record
CVE-2008-5352- Updated
- 2026-11-02
EUVDEUVD-2008-5329 No score
Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted applications and applets to gain privileges via a Pack200 compressed JAR file that triggers a heap-based buffer overflow.
- Record
EUVD-2008-5329- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pfr6-j3gf-9m85 No score
Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in...
Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted applications and applets to gain privileges via a Pack200 compressed JAR file that triggers a heap-based buffer overflow.
- Record
GHSA-pfr6-j3gf-9m85- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.6.0-sunRed Hat:rhel_extras:4 |
before 1:1.6.0.11-1jpp.1.el4 | 1:1.6.0.11-1jpp.1.el4 |
java-1.6.0-sun-demoRed Hat:rhel_extras:4 |
before 1:1.6.0.11-1jpp.1.el4 | 1:1.6.0.11-1jpp.1.el4 |
java-1.6.0-sun-develRed Hat:rhel_extras:4 |
before 1:1.6.0.11-1jpp.1.el4 | 1:1.6.0.11-1jpp.1.el4 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:4 |
before 1:1.6.0.11-1jpp.1.el4 | 1:1.6.0.11-1jpp.1.el4 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:4 |
before 1:1.6.0.11-1jpp.1.el4 | 1:1.6.0.11-1jpp.1.el4 |
java-1.6.0-sun-srcRed Hat:rhel_extras:4 |
before 1:1.6.0.11-1jpp.1.el4 | 1:1.6.0.11-1jpp.1.el4 |
java-1.6.0-sunRed Hat:rhel_extras:5::client |
before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sun-demoRed Hat:rhel_extras:5::client |
before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sun-develRed Hat:rhel_extras:5::client |
before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:5::client |
before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
Show 76 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.6.0-sun-pluginRed Hat:rhel_extras:5::client |
before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sun-srcRed Hat:rhel_extras:5::client |
before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sunRed Hat:rhel_extras:5::server |
before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sun-demoRed Hat:rhel_extras:5::server |
before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sun-develRed Hat:rhel_extras:5::server |
before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:5::server |
before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:5::server |
before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sun-srcRed Hat:rhel_extras:5::server |
before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.5.0-sunRed Hat:rhel_extras:4 |
before 0:1.5.0.17-1jpp.2.el4 | 0:1.5.0.17-1jpp.2.el4 |
java-1.5.0-sun-demoRed Hat:rhel_extras:4 |
before 0:1.5.0.17-1jpp.2.el4 | 0:1.5.0.17-1jpp.2.el4 |
java-1.5.0-sun-develRed Hat:rhel_extras:4 |
before 0:1.5.0.17-1jpp.2.el4 | 0:1.5.0.17-1jpp.2.el4 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:4 |
before 0:1.5.0.17-1jpp.2.el4 | 0:1.5.0.17-1jpp.2.el4 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:4 |
before 0:1.5.0.17-1jpp.2.el4 | 0:1.5.0.17-1jpp.2.el4 |
java-1.5.0-sun-srcRed Hat:rhel_extras:4 |
before 0:1.5.0.17-1jpp.2.el4 | 0:1.5.0.17-1jpp.2.el4 |
java-1.5.0-sunRed Hat:rhel_extras:5::client |
before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-demoRed Hat:rhel_extras:5::client |
before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-develRed Hat:rhel_extras:5::client |
before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:5::client |
before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:5::client |
before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-srcRed Hat:rhel_extras:5::client |
before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sunRed Hat:rhel_extras:5::server |
before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-demoRed Hat:rhel_extras:5::server |
before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-develRed Hat:rhel_extras:5::server |
before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:5::server |
before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:5::server |
before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-srcRed Hat:rhel_extras:5::server |
before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:4 |
before 1:1.6.0.3-1jpp.3.el4 | 1:1.6.0.3-1jpp.3.el4 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:4 |
before 1:1.6.0.3-1jpp.3.el4 | 1:1.6.0.3-1jpp.3.el4 |
java-1.6.0-ibm-develRed Hat:rhel_extras:4 |
before 1:1.6.0.3-1jpp.3.el4 | 1:1.6.0.3-1jpp.3.el4 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:4 |
before 1:1.6.0.3-1jpp.3.el4 | 1:1.6.0.3-1jpp.3.el4 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:4 |
before 1:1.6.0.3-1jpp.3.el4 | 1:1.6.0.3-1jpp.3.el4 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:4 |
before 1:1.6.0.3-1jpp.3.el4 | 1:1.6.0.3-1jpp.3.el4 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:4 |
before 1:1.6.0.3-1jpp.3.el4 | 1:1.6.0.3-1jpp.3.el4 |
java-1.6.0-ibmRed Hat:rhel_extras:5::client |
before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::client |
before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::client |
before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::client |
before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::client |
before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::client |
before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::client |
before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::client |
before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:5::server |
before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::server |
before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::server |
before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::server |
before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::server |
before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::server |
before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::server |
before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::server |
before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.5.0-ibmRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.4.el4 | 1:1.5.0.9-1jpp.4.el4 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.4.el4 | 1:1.5.0.9-1jpp.4.el4 |
java-1.5.0-ibm-develRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.4.el4 | 1:1.5.0.9-1jpp.4.el4 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.4.el4 | 1:1.5.0.9-1jpp.4.el4 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.4.el4 | 1:1.5.0.9-1jpp.4.el4 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.4.el4 | 1:1.5.0.9-1jpp.4.el4 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.4.el4 | 1:1.5.0.9-1jpp.4.el4 |
java-1.5.0-ibmRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-accessibilityRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-develRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibmRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-accessibilityRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-develRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibmRed Hat:network_satellite:5.2::el4 |
before 1:1.5.0.9-1jpp.4.el4 | 1:1.5.0.9-1jpp.4.el4 |
java-1.5.0-ibm-develRed Hat:network_satellite:5.2::el4 |
before 1:1.5.0.9-1jpp.4.el4 | 1:1.5.0.9-1jpp.4.el4 |
java-1.5.0-ibmRed Hat:network_satellite:5.2::el5 |
before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-develRed Hat:network_satellite:5.2::el5 |
before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-5352 is a high vulnerability (CVSS 9.3) in Sun Jdk, published December 5, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.06%, the 87th percentile. Fixed in java-1.6.0-sun 1:1.6.0.11-1jpp.1.el4.
References
secunia.com/advisories/34259
rhn.redhat.com/errata/RHSA-2008-1018.html
support.avaya.com/elmodocs2/security/ASA-2009-012.htm
security.gentoo.org/glsa/glsa-200911-02.xml
www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2009/03/024431-01.pdf
Show 127 moreShow less
lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html
sunsolve.sun.com/search/document.do?assetkey=1-26-244992-1
vupen.com/english/advisories/2008/3339
redhat.com/support/errata/RHSA-2009-0016.html
us-cert.gov/cas/techalerts/TA08-340A.html
support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=829914&poid=
osvdb.org/50501
labs.idefense.com/intelligence/vulnerabilities/display.php?id=759
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6383
securityfocus.com/bid/32608
securitytracker.com/id?1021312
nvd.nist.gov/vuln/detail/CVE-2008-5352
github.com/advisories/GHSA-pfr6-j3gf-9m85
access.redhat.com/errata/RHSA-2008:1018
blogs.sun.com/security/entry/advance_notification_of_security_updates3
bugzilla.redhat.com/show_bug.cgi?id=474556
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_1018.json
cve.org/CVERecord?id=CVE-2008-2086
www-128.ibm.com/developerworks/java/jdk/alerts