CVE-2019-19726

OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting a very small RLIMIT_DATA resource limit. When executing chpass or passwd (which are setuid root), _dl_setup_env in ld.so tries to strip LD_LIBRARY_PATH from the environment, but fails when it cannot allocate memory. Thus, the attacker is able to execute their own library code as root.

• CWE-269

• http://packetstormsecurity.com/files/155658/Qualys-Security-Advisory-OpenBSD-Dynamic-Loader-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/155764/OpenBSD-Dynamic-Loader-chpass-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.html
• http://seclists.org/fulldisclosure/2019/Dec/31Exploit, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2023/Oct/11
• http://www.openwall.com/lists/oss-security/2023/10/03/2
• https://seclists.org/bugtraq/2019/Dec/25Exploit, Mailing List, Third Party Advisory
• https://www.openbsd.org/errata66.htmlPatch, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2019/12/11/9Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/155658/Qualys-Security-Advisory-OpenBSD-Dynamic-Loader-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/155764/OpenBSD-Dynamic-Loader-chpass-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.html
• http://seclists.org/fulldisclosure/2019/Dec/31Exploit, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2023/Oct/11
• http://www.openwall.com/lists/oss-security/2023/10/03/2
• https://seclists.org/bugtraq/2019/Dec/25Exploit, Mailing List, Third Party Advisory
• https://www.openbsd.org/errata66.htmlPatch, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2019/12/11/9Mailing List, Third Party Advisory

Published

Dec 12, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1972A vulnerability the Cisco Enterprise NFV Infrastructure Soft…6.7
• CVE-2019-19720Yabasic 2.86.1 has a heap-based buffer overflow in the yylex…8.8
• CVE-2019-19721An off-by-one error in the DecodeBlock function in codec/sdl…7.8
• CVE-2019-19722In Dovecot before 2.3.9.2, an attacker can crash a push-noti…5.3
• CVE-2019-19724Insecure permissions (777) are set on $HOME/.singularity whe…7.5
• CVE-2019-19725sysstat through 12.2.0 has a double free in check_file_actls…9.8
• CVE-2019-19727SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has wea…5.5
• CVE-2019-19728SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 execute…7.5
• CVE-2019-19729An issue was discovered in the BSON ObjectID (aka bson-objec…7.5
• CVE-2019-1973A vulnerability in the web portal framework of Cisco Enterpr…4.8
• CVE-2019-19731Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal.…7.5
• CVE-2019-19732translation_manage_text.ajax.php and various *_manage.ajax.p…7.2