CVE-2003-0222: Oracle Database Server

High severity, CVSS 9.0. EPSS: 11% chance of exploitation in the next 30 days.

Stack-based buffer overflow in Oracle Net Services for Oracle Database Server 9i release 2 and earlier allows attackers to execute arbitrary code via a "CREATE DATABASE LINK" query containing a connect string with a long USING parameter.

Affected products

• Oracle Database Server: version 7.3.3 only; version 7.3.4 only; version 8.0.1 only; version 8.0.2 only; version 8.0.3 only; version 8.0.4 only; …
• Oracle ORACLE8I: version 8.0.6 only; version 8.0.6.3 only; version 8.0x only; version 8.1.5 only; version 8.1.6 only; version 8.1.7 only; …
• Oracle ORACLE9I: version 9.0 only; version 9.0.1 only; version 9.0.1.2 only; version 9.0.1.3 only; version 9.0.1.4 only; version 9.0.2 only; …

Published 2003-05-12. Last modified 2026-06-16.