Read the docs
TI-2002-01299 Aliases CVE-2002-1376GHSA-7mfp-q9xp-qq39

libmysqlclient client library in MySQL 3.x to 3.23.54, and 4.x to 4.0.6, does not…

Priority MEDIUM 43Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

libmysqlclient client library in MySQL 3.x to 3.23.54, and 4.x to 4.0.6, does not properly verify length fields for certain responses in the (1) read_rows or (2) read_one_row routines, which allows remote attackers to cause a denial of service and possibly execute arbitrary code.

Why it matters now

EPSS 0.06785 94th percentileScored 2026-11-07
Fix Fixed Red Hat: 5 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 62

CPEVersionsRoleVendor
cpe:2.3:a:oracle:mysql:3.22.26:*:*:*:*:*:*:*3.22.26VulnerableOracle
cpe:2.3:a:oracle:mysql:3.22.27:*:*:*:*:*:*:*3.22.27VulnerableOracle
cpe:2.3:a:oracle:mysql:3.22.28:*:*:*:*:*:*:*3.22.28VulnerableOracle
cpe:2.3:a:oracle:mysql:3.22.29:*:*:*:*:*:*:*3.22.29VulnerableOracle
cpe:2.3:a:oracle:mysql:3.22.30:*:*:*:*:*:*:*3.22.30VulnerableOracle
cpe:2.3:a:oracle:mysql:3.22.32:*:*:*:*:*:*:*3.22.32VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.2:*:*:*:*:*:*:*3.23.2VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.3:*:*:*:*:*:*:*3.23.3VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.4:*:*:*:*:*:*:*3.23.4VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.5:*:*:*:*:*:*:*3.23.5VulnerableOracle
  • cpe:2.3:a:oracle:mysql:3.22.26:*:*:*:*:*:*:* Versions 3.22.26 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.22.27:*:*:*:*:*:*:* Versions 3.22.27 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.22.28:*:*:*:*:*:*:* Versions 3.22.28 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.22.29:*:*:*:*:*:*:* Versions 3.22.29 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.22.30:*:*:*:*:*:*:* Versions 3.22.30 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.22.32:*:*:*:*:*:*:* Versions 3.22.32 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.2:*:*:*:*:*:*:* Versions 3.23.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.3:*:*:*:*:*:*:* Versions 3.23.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.4:*:*:*:*:*:*:* Versions 3.23.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.5:*:*:*:*:*:*:* Versions 3.23.5 Vulnerable ·Oracle
Show 52 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:mysql:3.23.8:*:*:*:*:*:*:*3.23.8VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.9:*:*:*:*:*:*:*3.23.9VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.10:*:*:*:*:*:*:*3.23.10VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.23:*:*:*:*:*:*:*3.23.23VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.24:*:*:*:*:*:*:*3.23.24VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.25:*:*:*:*:*:*:*3.23.25VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.26:*:*:*:*:*:*:*3.23.26VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.27:*:*:*:*:*:*:*3.23.27VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.28:*:*:*:*:*:*:*3.23.28VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.29:*:*:*:*:*:*:*3.23.29VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.30:*:*:*:*:*:*:*3.23.30VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.31:*:*:*:*:*:*:*3.23.31VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.34:*:*:*:*:*:*:*3.23.34VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.36:*:*:*:*:*:*:*3.23.36VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.37:*:*:*:*:*:*:*3.23.37VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.38:*:*:*:*:*:*:*3.23.38VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.39:*:*:*:*:*:*:*3.23.39VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.40:*:*:*:*:*:*:*3.23.40VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.41:*:*:*:*:*:*:*3.23.41VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.42:*:*:*:*:*:*:*3.23.42VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.43:*:*:*:*:*:*:*3.23.43VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.44:*:*:*:*:*:*:*3.23.44VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.45:*:*:*:*:*:*:*3.23.45VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.46:*:*:*:*:*:*:*3.23.46VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.47:*:*:*:*:*:*:*3.23.47VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.48:*:*:*:*:*:*:*3.23.48VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.49:*:*:*:*:*:*:*3.23.49VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.50:*:*:*:*:*:*:*3.23.50VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.51:*:*:*:*:*:*:*3.23.51VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.52:*:*:*:*:*:*:*3.23.52VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.53:*:*:*:*:*:*:*3.23.53VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.53a:*:*:*:*:*:*:*3.23.53aVulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.0:*:*:*:*:*:*:*4.0.0VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.1:*:*:*:*:*:*:*4.0.1VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.2:*:*:*:*:*:*:*4.0.2VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.3:*:*:*:*:*:*:*4.0.3VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.5a:*:*:*:*:*:*:*4.0.5aVulnerableOracle
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:3.4:*:*:*:*:*:*:*3.4VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5:*:*:*:*:*:*:*4.5VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_fp1:*:*:*:*:*:*:*4.5_fp1VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_fp2:*:*:*:*:*:*:*4.5_fp2VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_fp3:*:*:*:*:*:*:*4.5_fp3VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_mp1:*:*:*:*:*:*:*4.5_mp1VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_mp2:*:*:*:*:*:*:*4.5_mp2VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_mp3:*:*:*:*:*:*:*4.5_mp3VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5:*:*:*:*:*:*:*4.5VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_fp1:*:*:*:*:*:*:*4.5_fp1VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_fp2:*:*:*:*:*:*:*4.5_fp2VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_fp3:*:*:*:*:*:*:*4.5_fp3VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_mp1:*:*:*:*:*:*:*4.5_mp1VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_mp2:*:*:*:*:*:*:*4.5_mp2VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_mp3:*:*:*:*:*:*:*4.5_mp3VulnerableSymantec Veritas
  • cpe:2.3:a:oracle:mysql:3.23.8:*:*:*:*:*:*:* Versions 3.23.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.9:*:*:*:*:*:*:* Versions 3.23.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.10:*:*:*:*:*:*:* Versions 3.23.10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.23:*:*:*:*:*:*:* Versions 3.23.23 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.24:*:*:*:*:*:*:* Versions 3.23.24 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.25:*:*:*:*:*:*:* Versions 3.23.25 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.26:*:*:*:*:*:*:* Versions 3.23.26 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.27:*:*:*:*:*:*:* Versions 3.23.27 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.28:*:*:*:*:*:*:* Versions 3.23.28 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.29:*:*:*:*:*:*:* Versions 3.23.29 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.30:*:*:*:*:*:*:* Versions 3.23.30 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.31:*:*:*:*:*:*:* Versions 3.23.31 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.34:*:*:*:*:*:*:* Versions 3.23.34 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.36:*:*:*:*:*:*:* Versions 3.23.36 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.37:*:*:*:*:*:*:* Versions 3.23.37 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.38:*:*:*:*:*:*:* Versions 3.23.38 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.39:*:*:*:*:*:*:* Versions 3.23.39 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.40:*:*:*:*:*:*:* Versions 3.23.40 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.41:*:*:*:*:*:*:* Versions 3.23.41 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.42:*:*:*:*:*:*:* Versions 3.23.42 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.43:*:*:*:*:*:*:* Versions 3.23.43 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.44:*:*:*:*:*:*:* Versions 3.23.44 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.45:*:*:*:*:*:*:* Versions 3.23.45 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.46:*:*:*:*:*:*:* Versions 3.23.46 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.47:*:*:*:*:*:*:* Versions 3.23.47 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.48:*:*:*:*:*:*:* Versions 3.23.48 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.49:*:*:*:*:*:*:* Versions 3.23.49 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.50:*:*:*:*:*:*:* Versions 3.23.50 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.51:*:*:*:*:*:*:* Versions 3.23.51 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.52:*:*:*:*:*:*:* Versions 3.23.52 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.53:*:*:*:*:*:*:* Versions 3.23.53 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.53a:*:*:*:*:*:*:* Versions 3.23.53a Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.3:*:*:*:*:*:*:* Versions 4.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.5a:*:*:*:*:*:*:* Versions 4.0.5a Vulnerable ·Oracle
  • cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5:*:*:*:*:*:*:* Versions 4.5 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_fp1:*:*:*:*:*:*:* Versions 4.5_fp1 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_fp2:*:*:*:*:*:*:* Versions 4.5_fp2 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_fp3:*:*:*:*:*:*:* Versions 4.5_fp3 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_mp1:*:*:*:*:*:*:* Versions 4.5_mp1 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_mp2:*:*:*:*:*:*:* Versions 4.5_mp2 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_mp3:*:*:*:*:*:*:* Versions 4.5_mp3 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5:*:*:*:*:*:*:* Versions 4.5 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_fp1:*:*:*:*:*:*:* Versions 4.5_fp1 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_fp2:*:*:*:*:*:*:* Versions 4.5_fp2 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_fp3:*:*:*:*:*:*:* Versions 4.5_fp3 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_mp1:*:*:*:*:*:*:* Versions 4.5_mp1 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_mp2:*:*:*:*:*:*:* Versions 4.5_mp2 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_mp3:*:*:*:*:*:*:* Versions 4.5_mp3 Vulnerable ·Symantec Veritas

Remediation

Red Hat 5 advisories

  • RHSA-2003:166 Released 2003-05-15 · Red Hat rating Important
    : : : Updated MySQL packages fix vulnerabilities
    • Red Hat Linux 7.1
  • RHSA-2003:104 Released 2003-03-18 · Red Hat rating Important
    apache, openssl, php security update for Stronghold
    • Red Hat Stronghold 3
  • RHSA-2003:082 Released 2003-03-03 · Red Hat rating Important
    apache, openssl, php, tomcat security update for Stronghold
    • Red Hat Stronghold 4
Show 2 more Red Hat advisories
  • RHSA-2002:288 Released 2003-01-15 · Red Hat rating Important
    : Updated MySQL packages fix various security issues
    • Red Hat Linux 7.0
    • Red Hat Linux 7.1
    • Red Hat Linux 7.2
    • Red Hat Linux 7.3
    • Red Hat Linux 8.0
  • RHSA-2002:289 Released 2003-01-06 · Red Hat rating Important
    mysql security update
    • Red Hat Enterprise Linux AS (Advanced Server) version 2.1
    • Red Hat Linux Advanced Workstation 2.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 Fixed RHSA-2002:289
Red Hat Linux 7.0Fixed RHSA-2002:288
Red Hat Linux 7.1Fixed RHSA-2002:288
Red Hat Linux 7.2Fixed RHSA-2002:288
Red Hat Linux 7.3Fixed RHSA-2002:288
Red Hat Linux 8.0Fixed RHSA-2002:288
Red Hat Linux Advanced Workstation 2.1Fixed RHSA-2002:289
Red Hat Stronghold 3Fixed RHSA-2003:104
Red Hat Stronghold 4Fixed RHSA-2003:082

Timeline

  1. 2026-10-02 Threatist record created from CVE-2002-1376
  2. 2026-10-03 Alias added: GHSA-7mfp-q9xp-qq39

References

Patch 1

Advisory 4

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences