Read the docs
TI-2003-00723 Aliases CVE-2003-0780GHSA-fq6h-5jh8-rmxv

Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier…

Priority HIGH 78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier, and 3.23.x, allows attackers with ALTER TABLE privileges to execute arbitrary code via a long Password field.

Why it matters now

EPSS 0.78367 99th percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 70

CPEVersionsRoleVendor
cpe:2.3:a:mysql:mysql:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableMysql
cpe:2.3:a:oracle:mysql:3.23:*:*:*:*:*:*:*3.23VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.2:*:*:*:*:*:*:*3.23.2VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.3:*:*:*:*:*:*:*3.23.3VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.4:*:*:*:*:*:*:*3.23.4VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.5:*:*:*:*:*:*:*3.23.5VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.8:*:*:*:*:*:*:*3.23.8VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.9:*:*:*:*:*:*:*3.23.9VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.10:*:*:*:*:*:*:*3.23.10VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.22:*:*:*:*:*:*:*3.23.22VulnerableOracle
  • cpe:2.3:a:mysql:mysql:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Mysql
  • cpe:2.3:a:oracle:mysql:3.23:*:*:*:*:*:*:* Versions 3.23 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.2:*:*:*:*:*:*:* Versions 3.23.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.3:*:*:*:*:*:*:* Versions 3.23.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.4:*:*:*:*:*:*:* Versions 3.23.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.5:*:*:*:*:*:*:* Versions 3.23.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.8:*:*:*:*:*:*:* Versions 3.23.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.9:*:*:*:*:*:*:* Versions 3.23.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.10:*:*:*:*:*:*:* Versions 3.23.10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.22:*:*:*:*:*:*:* Versions 3.23.22 Vulnerable ·Oracle
Show 60 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:mysql:3.23.23:*:*:*:*:*:*:*3.23.23VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.24:*:*:*:*:*:*:*3.23.24VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.25:*:*:*:*:*:*:*3.23.25VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.26:*:*:*:*:*:*:*3.23.26VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.27:*:*:*:*:*:*:*3.23.27VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.28:*:*:*:*:*:*:*3.23.28VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.28:gamma:*:*:*:*:*:*3.23.28 gammaVulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.29:*:*:*:*:*:*:*3.23.29VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.30:*:*:*:*:*:*:*3.23.30VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.31:*:*:*:*:*:*:*3.23.31VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.32:*:*:*:*:*:*:*3.23.32VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.33:*:*:*:*:*:*:*3.23.33VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.34:*:*:*:*:*:*:*3.23.34VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.36:*:*:*:*:*:*:*3.23.36VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.37:*:*:*:*:*:*:*3.23.37VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.38:*:*:*:*:*:*:*3.23.38VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.39:*:*:*:*:*:*:*3.23.39VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.40:*:*:*:*:*:*:*3.23.40VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.41:*:*:*:*:*:*:*3.23.41VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.42:*:*:*:*:*:*:*3.23.42VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.43:*:*:*:*:*:*:*3.23.43VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.44:*:*:*:*:*:*:*3.23.44VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.45:*:*:*:*:*:*:*3.23.45VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.46:*:*:*:*:*:*:*3.23.46VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.47:*:*:*:*:*:*:*3.23.47VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.48:*:*:*:*:*:*:*3.23.48VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.49:*:*:*:*:*:*:*3.23.49VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.50:*:*:*:*:*:*:*3.23.50VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.51:*:*:*:*:*:*:*3.23.51VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.52:*:*:*:*:*:*:*3.23.52VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.53:*:*:*:*:*:*:*3.23.53VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.53a:*:*:*:*:*:*:*3.23.53aVulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.54:*:*:*:*:*:*:*3.23.54VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.54a:*:*:*:*:*:*:*3.23.54aVulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.55:*:*:*:*:*:*:*3.23.55VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.56:*:*:*:*:*:*:*3.23.56VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.0:*:*:*:*:*:*:*4.0.0VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.1:*:*:*:*:*:*:*4.0.1VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.2:*:*:*:*:*:*:*4.0.2VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.3:*:*:*:*:*:*:*4.0.3VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.4:*:*:*:*:*:*:*4.0.4VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.5:*:*:*:*:*:*:*4.0.5VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.5a:*:*:*:*:*:*:*4.0.5aVulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.6:*:*:*:*:*:*:*4.0.6VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.7:*:*:*:*:*:*:*4.0.7VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.7:gamma:*:*:*:*:*:*4.0.7 gammaVulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.8:*:*:*:*:*:*:*4.0.8VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.8:gamma:*:*:*:*:*:*4.0.8 gammaVulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.9:*:*:*:*:*:*:*4.0.9VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.9:gamma:*:*:*:*:*:*4.0.9 gammaVulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.10:*:*:*:*:*:*:*4.0.10VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.11:*:*:*:*:*:*:*4.0.11VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.11:gamma:*:*:*:*:*:*4.0.11 gammaVulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.12:*:*:*:*:*:*:*4.0.12VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.13:*:*:*:*:*:*:*4.0.13VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.14:*:*:*:*:*:*:*4.0.14VulnerableOracle
cpe:2.3:a:oracle:mysql:4.1.0:alpha:*:*:*:*:*:*4.1.0 alphaVulnerableOracle
cpe:2.3:o:conectiva:linux:7.0:*:*:*:*:*:*:*7.0VulnerableConectiva
cpe:2.3:o:conectiva:linux:8.0:*:*:*:*:*:*:*8.0VulnerableConectiva
cpe:2.3:o:conectiva:linux:9.0:*:*:*:*:*:*:*9.0VulnerableConectiva
  • cpe:2.3:a:oracle:mysql:3.23.23:*:*:*:*:*:*:* Versions 3.23.23 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.24:*:*:*:*:*:*:* Versions 3.23.24 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.25:*:*:*:*:*:*:* Versions 3.23.25 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.26:*:*:*:*:*:*:* Versions 3.23.26 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.27:*:*:*:*:*:*:* Versions 3.23.27 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.28:*:*:*:*:*:*:* Versions 3.23.28 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.28:gamma:*:*:*:*:*:* Versions 3.23.28 gamma Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.29:*:*:*:*:*:*:* Versions 3.23.29 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.30:*:*:*:*:*:*:* Versions 3.23.30 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.31:*:*:*:*:*:*:* Versions 3.23.31 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.32:*:*:*:*:*:*:* Versions 3.23.32 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.33:*:*:*:*:*:*:* Versions 3.23.33 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.34:*:*:*:*:*:*:* Versions 3.23.34 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.36:*:*:*:*:*:*:* Versions 3.23.36 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.37:*:*:*:*:*:*:* Versions 3.23.37 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.38:*:*:*:*:*:*:* Versions 3.23.38 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.39:*:*:*:*:*:*:* Versions 3.23.39 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.40:*:*:*:*:*:*:* Versions 3.23.40 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.41:*:*:*:*:*:*:* Versions 3.23.41 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.42:*:*:*:*:*:*:* Versions 3.23.42 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.43:*:*:*:*:*:*:* Versions 3.23.43 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.44:*:*:*:*:*:*:* Versions 3.23.44 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.45:*:*:*:*:*:*:* Versions 3.23.45 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.46:*:*:*:*:*:*:* Versions 3.23.46 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.47:*:*:*:*:*:*:* Versions 3.23.47 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.48:*:*:*:*:*:*:* Versions 3.23.48 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.49:*:*:*:*:*:*:* Versions 3.23.49 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.50:*:*:*:*:*:*:* Versions 3.23.50 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.51:*:*:*:*:*:*:* Versions 3.23.51 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.52:*:*:*:*:*:*:* Versions 3.23.52 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.53:*:*:*:*:*:*:* Versions 3.23.53 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.53a:*:*:*:*:*:*:* Versions 3.23.53a Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.54:*:*:*:*:*:*:* Versions 3.23.54 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.54a:*:*:*:*:*:*:* Versions 3.23.54a Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.55:*:*:*:*:*:*:* Versions 3.23.55 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.56:*:*:*:*:*:*:* Versions 3.23.56 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.3:*:*:*:*:*:*:* Versions 4.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.4:*:*:*:*:*:*:* Versions 4.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.5:*:*:*:*:*:*:* Versions 4.0.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.5a:*:*:*:*:*:*:* Versions 4.0.5a Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.6:*:*:*:*:*:*:* Versions 4.0.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.7:*:*:*:*:*:*:* Versions 4.0.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.7:gamma:*:*:*:*:*:* Versions 4.0.7 gamma Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.8:*:*:*:*:*:*:* Versions 4.0.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.8:gamma:*:*:*:*:*:* Versions 4.0.8 gamma Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.9:*:*:*:*:*:*:* Versions 4.0.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.9:gamma:*:*:*:*:*:* Versions 4.0.9 gamma Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.10:*:*:*:*:*:*:* Versions 4.0.10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.11:*:*:*:*:*:*:* Versions 4.0.11 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.11:gamma:*:*:*:*:*:* Versions 4.0.11 gamma Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.12:*:*:*:*:*:*:* Versions 4.0.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.13:*:*:*:*:*:*:* Versions 4.0.13 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.14:*:*:*:*:*:*:* Versions 4.0.14 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.1.0:alpha:*:*:*:*:*:* Versions 4.1.0 alpha Vulnerable ·Oracle
  • cpe:2.3:o:conectiva:linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Conectiva
  • cpe:2.3:o:conectiva:linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Conectiva
  • cpe:2.3:o:conectiva:linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Conectiva

Remediation

Red Hat 2 advisories

  • RHSA-2003:281 Released 2003-10-09 · Red Hat rating Important
    : Updated MySQL packages fix vulnerability
    • Red Hat Linux 7.1
    • Red Hat Linux 7.2
    • Red Hat Linux 7.3
    • Red Hat Linux 8.0
    • Red Hat Linux 9
  • RHSA-2003:282 Released 2003-10-09 · Red Hat rating Important
    mysql security update
    • Red Hat Enterprise Linux AS (Advanced Server) version 2.1
    • Red Hat Enterprise Linux ES version 2.1
    • Red Hat Enterprise Linux WS version 2.1
    • Red Hat Linux Advanced Workstation 2.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 Fixed RHSA-2003:282
Red Hat Enterprise Linux ES version 2.1Fixed RHSA-2003:282
Red Hat Enterprise Linux WS version 2.1Fixed RHSA-2003:282
Red Hat Linux 7.1Fixed RHSA-2003:281
Red Hat Linux 7.2Fixed RHSA-2003:281
Red Hat Linux 7.3Fixed RHSA-2003:281
Red Hat Linux 8.0Fixed RHSA-2003:281
Red Hat Linux 9Fixed RHSA-2003:281
Red Hat Linux Advanced Workstation 2.1Fixed RHSA-2003:282

Timeline

  1. 2026-10-02 Threatist record created from CVE-2003-0780
  2. 2026-10-03 Alias added: GHSA-fq6h-5jh8-rmxv

References

Patch 2

Advisory 5

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences