CVE-2008-5352: Sun JDK

High severity, CVSS 9.3. EPSS: 3.1% chance of exploitation in the next 30 days.

Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted applications and applets to gain privileges via a Pack200 compressed JAR file that triggers a heap-based buffer overflow.

Affected products

• Sun JDK: up to and including 5.0; up to and including 6; version 5.0 only; version 6 only
• Sun JRE: up to and including 5.0; up to and including 6; version 5.0 only; version 6 only

Published 2008-12-05. Last modified 2026-06-16.