CVE-2019-19520

PoC ×3—

CVSS 3.1

7.8 high

EPSS

1%p70

Published

Dec 5, 2019 (Dec 5, 2019)

Modified

Jun 17, 2026

Description

xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH environment variable, because xenocara/lib/mesa/src/loader/loader.c mishandles dlopen.

Vendors: openbsd
Products: openbsd
Weakness: CWE-863
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.4%)

In the news2 stories

Severe Auth Bypass and Priv

The Hacker NewsDec 5, 12:02 UTC · Dec 5, 2019Exploit / PoC CVE-2019-19521 CVE-2019-19520 CVE-2019-19522+1 CVEs

OpenBSD addresses authentication bypass, privilege escalation issues

Security AffairsDec 6, 06:33 UTC · Dec 6, 2019Vulnerability CVE-2019-19521 CVE-2019-19520 CVE-2019-19522+1 CVEs