CVE-2002-1376: Oracle MySQL

High severity, CVSS 7.5. EPSS: 6.8% chance of exploitation in the next 30 days.

libmysqlclient client library in MySQL 3.x to 3.23.54, and 4.x to 4.0.6, does not properly verify length fields for certain responses in the (1) read_rows or (2) read_one_row routines, which allows remote attackers to cause a denial of service and possibly execute arbitrary code.

Affected products

• Oracle MySQL: version 3.22.26 only; version 3.22.27 only; version 3.22.28 only; version 3.22.29 only; version 3.22.30 only; version 3.22.32 only; …
• Symantec Veritas Netbackup Advanced Reporter: version 3.4 only; version 4.5 only; version 4.5_fp1 only; version 4.5_fp2 only; version 4.5_fp3 only; version 4.5_mp1 only; …
• Symantec Veritas Netbackup Global Data Manager: version 4.5 only; version 4.5_fp1 only; version 4.5_fp2 only; version 4.5_fp3 only; version 4.5_mp1 only; version 4.5_mp2 only; …

Published 2002-12-23. Last modified 2026-06-16.