Skip to content
Fencer Intel
medium 5.1

CVE-2019-5068 json

An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2.

published 7y ago modified 4mo ago also EUVD-2019-14673

cvss
5.1
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2. An attacker can access the shared memory without any specific permissions to trigger this vulnerability.

Patch / fix

  • mesa Debian 14, Debian 13, Debian 12 19.2.6-1

debian advisories DEBIAN-CVE-2019-5068

  • mesa Ubuntu 18.04 LTS 19.2.8-0ubuntu0~18.04.2

ubuntu advisories UBUNTU-CVE-2019-5068

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • Mesa SLES 12 SP2-BCL, SLE Software Development Kit 12 SP5 11.2.1-104.9.49
  • Mesa SLE Module for Package Hub 15 SP1, SLE Module for Basesystem 15 SP1 18.3.2-34.9.1
  • Mesa SLES for SAP 12 SP5, SLES 12 SP5, SLE Workstation Extension 12 SP5 +1 more 18.3.2-14.3.2
  • Mesa-drivers SLES for SAP 12 SP5, SLES 12 SP5, SLE Workstation Extension 12 SP5 +1 more 18.3.2-14.3.2
  • Mesa SLES for SAP 12 SP4, SLES 12 SP4, SLED 12 SP4 +2 more 18.0.2-8.3.2
  • Mesa-drivers SLES for SAP 12 SP4, SLES 12 SP4, SLED 12 SP4 +1 more 18.0.2-8.3.2
  • Mesa SLE Module for Basesystem 15 18.0.2-27.6.1
  • Mesa-drivers SLE Workstation Extension 15, SLE Module for Basesystem 15 18.0.2-27.6.1

suse advisories SUSE-SU-2021:3117-1SUSE-SU-2020:0111-2SUSE-SU-2020:0146-1SUSE-SU-2020:0145-1SUSE-SU-2020:0132-1SUSE-SU-2020:0111-1

  • Mesa openSUSE Leap 15.1 18.3.2-lp151.23.9.1
  • Mesa-drivers openSUSE Leap 15.1 18.3.2-lp151.23.9.1

opensuse advisories openSUSE-SU-2020:0084-1

Is CVE-2019-5068 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-5068 updated cvss 5.1

mesa: security bypass in 3D library graphics

  • Red Hat Enterprise Linux 5 mesa Red Hat Enterprise Linux 6 mesa, glx-utils, mesa-demos, mesa-libGL, mesa-libEGL, mesa-libgbm, +4 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 mesa, mesa-libGL, mesa-libEGL, mesa-libgbm, mesa-libGLES, mesa-libglapi, +7 more Red Hat Enterprise Linux 8 mesa, mesa-libGL, mesa-libEGL, mesa-libgbm, mesa-libglapi, mesa-libOSMesa, +5 more
    affected: no fix planned “Will not fix”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • talosintelligence.com https://talosintelligence.com/vulnerability_reports/TALOS-2019-0857 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 5.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD 3.1 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD 2.0 3.6 AV:L/AC:L/Au:N/C:P/I:P/A:N

Affected products

  • n/a Mesa 3D X11 Graphics library

Classification

Weakness
  • CWE-277 Insecure Inherited Permissions
  • CWE-732 Incorrect Permission Assignment for Critical Resource

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.