CVE-2008-5352
Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in...
9.3 High
CVE-2008-5352 is a high vulnerability (CVSS 9.3) in Sun Jdk, published December 5, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.06%, the 87th percentile. No source names a fixed version.
- Severity
- 9.3 HighCVSS 2.0, NVD
- Exploit chance
- 3.06%EPSS, 87th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted applications and applets to gain privileges via a Pack200 compressed JAR file that triggers a heap-based buffer overflow.
Exploit likelihood
3.06%Up 0.4 points since Feb 4, 2022
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.6.0-sunRed Hat:rhel_extras:4 From an advisory covering 21 CVEs | before 1:1.6.0.11-1jpp.1.el4 | 1:1.6.0.11-1jpp.1.el4 |
java-1.6.0-sun-demoRed Hat:rhel_extras:4 From an advisory covering 21 CVEs | before 1:1.6.0.11-1jpp.1.el4 | 1:1.6.0.11-1jpp.1.el4 |
java-1.6.0-sun-develRed Hat:rhel_extras:4 From an advisory covering 21 CVEs | before 1:1.6.0.11-1jpp.1.el4 | 1:1.6.0.11-1jpp.1.el4 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:4 From an advisory covering 21 CVEs | before 1:1.6.0.11-1jpp.1.el4 | 1:1.6.0.11-1jpp.1.el4 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:4 From an advisory covering 21 CVEs | before 1:1.6.0.11-1jpp.1.el4 | 1:1.6.0.11-1jpp.1.el4 |
java-1.6.0-sun-srcRed Hat:rhel_extras:4 From an advisory covering 21 CVEs | before 1:1.6.0.11-1jpp.1.el4 | 1:1.6.0.11-1jpp.1.el4 |
java-1.6.0-sunRed Hat:rhel_extras:5::client From an advisory covering 21 CVEs | before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sun-demoRed Hat:rhel_extras:5::client From an advisory covering 21 CVEs | before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sun-develRed Hat:rhel_extras:5::client From an advisory covering 21 CVEs | before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:5::client From an advisory covering 21 CVEs | before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
Show 76 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.6.0-sun-pluginRed Hat:rhel_extras:5::client From an advisory covering 21 CVEs | before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sun-srcRed Hat:rhel_extras:5::client From an advisory covering 21 CVEs | before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sunRed Hat:rhel_extras:5::server From an advisory covering 21 CVEs | before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sun-demoRed Hat:rhel_extras:5::server From an advisory covering 21 CVEs | before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sun-develRed Hat:rhel_extras:5::server From an advisory covering 21 CVEs | before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:5::server From an advisory covering 21 CVEs | before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:5::server From an advisory covering 21 CVEs | before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.6.0-sun-srcRed Hat:rhel_extras:5::server From an advisory covering 21 CVEs | before 1:1.6.0.11-1jpp.1.el5 | 1:1.6.0.11-1jpp.1.el5 |
java-1.5.0-sunRed Hat:rhel_extras:4 From an advisory covering 20 CVEs | before 0:1.5.0.17-1jpp.2.el4 | 0:1.5.0.17-1jpp.2.el4 |
java-1.5.0-sun-demoRed Hat:rhel_extras:4 From an advisory covering 20 CVEs | before 0:1.5.0.17-1jpp.2.el4 | 0:1.5.0.17-1jpp.2.el4 |
java-1.5.0-sun-develRed Hat:rhel_extras:4 From an advisory covering 20 CVEs | before 0:1.5.0.17-1jpp.2.el4 | 0:1.5.0.17-1jpp.2.el4 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:4 From an advisory covering 20 CVEs | before 0:1.5.0.17-1jpp.2.el4 | 0:1.5.0.17-1jpp.2.el4 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:4 From an advisory covering 20 CVEs | before 0:1.5.0.17-1jpp.2.el4 | 0:1.5.0.17-1jpp.2.el4 |
java-1.5.0-sun-srcRed Hat:rhel_extras:4 From an advisory covering 20 CVEs | before 0:1.5.0.17-1jpp.2.el4 | 0:1.5.0.17-1jpp.2.el4 |
java-1.5.0-sunRed Hat:rhel_extras:5::client From an advisory covering 20 CVEs | before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-demoRed Hat:rhel_extras:5::client From an advisory covering 20 CVEs | before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-develRed Hat:rhel_extras:5::client From an advisory covering 20 CVEs | before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:5::client From an advisory covering 20 CVEs | before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:5::client From an advisory covering 20 CVEs | before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-srcRed Hat:rhel_extras:5::client From an advisory covering 20 CVEs | before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sunRed Hat:rhel_extras:5::server From an advisory covering 20 CVEs | before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-demoRed Hat:rhel_extras:5::server From an advisory covering 20 CVEs | before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-develRed Hat:rhel_extras:5::server From an advisory covering 20 CVEs | before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:5::server From an advisory covering 20 CVEs | before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:5::server From an advisory covering 20 CVEs | before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.5.0-sun-srcRed Hat:rhel_extras:5::server From an advisory covering 20 CVEs | before 0:1.5.0.17-1jpp.2.el5 | 0:1.5.0.17-1jpp.2.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:4 From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.3.el4 | 1:1.6.0.3-1jpp.3.el4 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:4 From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.3.el4 | 1:1.6.0.3-1jpp.3.el4 |
java-1.6.0-ibm-develRed Hat:rhel_extras:4 From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.3.el4 | 1:1.6.0.3-1jpp.3.el4 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:4 From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.3.el4 | 1:1.6.0.3-1jpp.3.el4 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:4 From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.3.el4 | 1:1.6.0.3-1jpp.3.el4 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:4 From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.3.el4 | 1:1.6.0.3-1jpp.3.el4 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:4 From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.3.el4 | 1:1.6.0.3-1jpp.3.el4 |
java-1.6.0-ibmRed Hat:rhel_extras:5::client From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::client From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::client From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::client From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::client From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::client From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::client From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::client From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:5::server From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::server From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::server From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::server From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::server From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::server From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::server From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::server From an advisory covering 12 CVEs | before 1:1.6.0.3-1jpp.1.el5 | 1:1.6.0.3-1jpp.1.el5 |
java-1.5.0-ibmRed Hat:rhel_extras:4 From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.4.el4 | 1:1.5.0.9-1jpp.4.el4 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:4 From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.4.el4 | 1:1.5.0.9-1jpp.4.el4 |
java-1.5.0-ibm-develRed Hat:rhel_extras:4 From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.4.el4 | 1:1.5.0.9-1jpp.4.el4 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:4 From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.4.el4 | 1:1.5.0.9-1jpp.4.el4 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:4 From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.4.el4 | 1:1.5.0.9-1jpp.4.el4 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:4 From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.4.el4 | 1:1.5.0.9-1jpp.4.el4 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:4 From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.4.el4 | 1:1.5.0.9-1jpp.4.el4 |
java-1.5.0-ibmRed Hat:rhel_extras:5::client From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-accessibilityRed Hat:rhel_extras:5::client From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:5::client From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-develRed Hat:rhel_extras:5::client From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:5::client From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:5::client From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:5::client From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:5::client From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibmRed Hat:rhel_extras:5::server From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-accessibilityRed Hat:rhel_extras:5::server From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:5::server From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-develRed Hat:rhel_extras:5::server From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:5::server From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:5::server From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:5::server From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:5::server From an advisory covering 20 CVEs | before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibmRed Hat:network_satellite:5.2::el4 From an advisory covering 14 CVEs | before 1:1.5.0.9-1jpp.4.el4 | 1:1.5.0.9-1jpp.4.el4 |
java-1.5.0-ibm-develRed Hat:network_satellite:5.2::el4 From an advisory covering 14 CVEs | before 1:1.5.0.9-1jpp.4.el4 | 1:1.5.0.9-1jpp.4.el4 |
java-1.5.0-ibmRed Hat:network_satellite:5.2::el5 From an advisory covering 14 CVEs | before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
java-1.5.0-ibm-develRed Hat:network_satellite:5.2::el5 From an advisory covering 14 CVEs | before 1:1.5.0.9-1jpp.2.el5 | 1:1.5.0.9-1jpp.2.el5 |
What each source reports
NVD Score used
Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted applications and applets to gain privileges via a Pack200 compressed JAR file that triggers a heap-based buffer overflow.
- Record
CVE-2008-5352- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE ListNo score
Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted applications and applets to gain privileges via a Pack200 compressed JAR file that triggers a heap-based buffer overflow.
- Record
CVE-2008-5352- Updated
- 2026-11-02
EUVDEUVD-2008-5329No score
Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted applications and applets to gain privileges via a Pack200 compressed JAR file that triggers a heap-based buffer overflow.
- Record
EUVD-2008-5329- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pfr6-j3gf-9m85No score
Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in...
Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted applications and applets to gain privileges via a Pack200 compressed JAR file that triggers a heap-based buffer overflow.
- Record
GHSA-pfr6-j3gf-9m85- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/34259
rhn.redhat.com/errata/RHSA-2008-1018.html
support.avaya.com/elmodocs2/security/ASA-2009-012.htm
security.gentoo.org/glsa/glsa-200911-02.xml
www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2009/03/024431-01.pdf
Show 127 moreShow less
lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html
sunsolve.sun.com/search/document.do?assetkey=1-26-244992-1
vupen.com/english/advisories/2008/3339
redhat.com/support/errata/RHSA-2009-0016.html
us-cert.gov/cas/techalerts/TA08-340A.html
support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=829914&poid=
osvdb.org/50501
labs.idefense.com/intelligence/vulnerabilities/display.php?id=759
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6383
securityfocus.com/bid/32608
securitytracker.com/id?1021312
nvd.nist.gov/vuln/detail/CVE-2008-5352
github.com/advisories/GHSA-pfr6-j3gf-9m85
access.redhat.com/errata/RHSA-2008:1018
blogs.sun.com/security/entry/advance_notification_of_security_updates3
bugzilla.redhat.com/show_bug.cgi?id=474556
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_1018.json
cve.org/CVERecord?id=CVE-2008-2086
www-128.ibm.com/developerworks/java/jdk/alerts