CVE-2003-0095: Oracle Database Server

High severity, CVSS 10.0. EPSS: 13.1% chance of exploitation in the next 30 days.

Buffer overflow in ORACLE.EXE for Oracle Database Server 9i, 8i, 8.1.7, and 8.0.6 allows remote attackers to execute arbitrary code via a long username that is provided during login, as exploitable through client applications that perform their own authentication, as demonstrated using LOADPSP.

Affected products

• Oracle Database Server: version 8.0.6 only; version 9.2.1 only; version 9.2.2 only
• Oracle ORACLE8I: version 8.1.7 only; version 8.1.7.1 only
• Oracle ORACLE9I: version 9.0 only; version 9.0.1 only; version 9.0.1.2 only; version 9.0.1.3 only; version 9.0.2 only

Published 2003-03-03. Last modified 2026-06-16.