CVE-2018-19120

The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger...

7.5 HighFix available

The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

1.46%Up 0.8 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.

Record: CVE-2018-19120
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.

Record: CVE-2018-19120
Updated: 2026-11-02

EUVDEUVD-2018-10833 No score

The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.

Record: EUVD-2018-10833
Updated: 2026-11-03

GitHub AdvisoriesGHSA-39rp-qwx2-562v 7.5

The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger...

The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.

Record: GHSA-39rp-qwx2-562v
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSV 7.5

The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.

Record: CVE-2018-19120
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-19120 7.5

The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.

Record: DEBIAN-CVE-2018-19120
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-19120 7.5

The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.

Record: UBUNTU-CVE-2018-19120
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVMGASA-2018-0477 No score

Updated kio-extras packages fix security vulnerability

The HTML thumbnailer was incorrectly accessing some content of remote URLs listed in HTML files. This meant that the owners of the servers referred in HTML files in your system could have seen in their access logs your IP address every time the thumbnailer tried to create the thumbnail (CVE-2018-19120).

Record: MGASA-2018-0477
Updated: 2026-11-02

Affected products

kde applications

Affected packages

Affected packages
Package	Affected	Fixed
`kio-extras` Debian:12	before 4:18.08.3-1	4:18.08.3-1
`kio-extras` Debian:13	before 4:18.08.3-1	4:18.08.3-1
`kio-extras` Debian:14	before 4:18.08.3-1	4:18.08.3-1
`kio-extras` Mageia:6	before 17.12.2-4.1.mga6	17.12.2-4.1.mga6
`kde-runtime` Ubuntu:16.04:LTS	All versions, plus listed versions 4:15.08.2-0ubuntu14:15.12.1-0ubuntu14:15.12.3-0ubuntu1	None known
`kio-extras` Ubuntu:16.04:LTS	All versions, plus listed versions 4:15.08.2-0ubuntu14:15.12.1-1ubuntu14:15.12.3-0ubuntu1	None known
`kde-runtime` Ubuntu:18.04:LTS	All versions, plus listed versions 4:17.04.3-0ubuntu14:17.08.3-0ubuntu1	None known
`kio-extras` Ubuntu:18.04:LTS	All versions, plus listed versions 4:17.04.3-0ubuntu14:17.08.3-0ubuntu14:17.12.2-0ubuntu14:17.12.3-0ubuntu14:17.12.3-0ubuntu2	None known
`kio-extras` Ubuntu:20.04:LTS	All versions, plus listed versions 4:19.04.3-0ubuntu14:19.08.1-14:19.08.3-0ubuntu14:19.08.3-0ubuntu24:19.12.0-0ubuntu1 Show 4 moreShow less 4:19.12.1-0ubuntu14:19.12.2-0ubuntu14:19.12.3a-0ubuntu14:19.12.3a-0ubuntu2	None known
`kio-extras` Ubuntu:22.04:LTS	All versions, plus listed versions 4:21.08.1-0ubuntu14:21.08.3-0ubuntu14:21.08.3-1ubuntu14:21.11.80-0ubuntu14:21.11.90-0ubuntu1 Show 5 moreShow less 4:21.11.90-0ubuntu24:21.12.0-0ubuntu14:21.12.1-0ubuntu14:21.12.2-0ubuntu14:21.12.3-0ubuntu1	None known

Show 4 moreShow less

Affected packages
Package	Affected	Fixed
`kio-extras` Ubuntu:24.04:LTS	All versions, plus listed versions 4:23.08.1-0ubuntu14:23.08.2-0ubuntu14:23.08.3-0ubuntu14:23.08.4-0ubuntu14:23.08.4-1ubuntu1 Show 4 moreShow less 4:23.08.5-0ubuntu14:23.08.5-0ubuntu34:23.08.5-0ubuntu44:23.08.5-0ubuntu5	None known
`kio-extras` Ubuntu:25.10	All versions, plus listed versions 4:24.12.3-0ubuntu14:25.04.0-0ubuntu14:25.04.1-0ubuntu14:25.04.2-0ubuntu14:25.04.2-1ubuntu1 Show 5 moreShow less 4:25.04.3-0ubuntu14:25.07.80-0ubuntu14:25.07.90-0ubuntu14:25.08.0-0ubuntu14:25.08.1-0ubuntu1	None known
`kio-extras` Ubuntu:26.10	All versions, plus listed versions 4:25.12.3-0ubuntu14:26.04.2-0ubuntu14:26.04.3-0ubuntu14:26.07.90-0ubuntu14:26.08.0-0ubuntu14:26.08.1-0ubuntu1	None known
`kio-extras` Ubuntu:26.04:LTS	All versions, plus listed versions 4:25.08.1-0ubuntu14:25.08.2-0ubuntu14:25.08.2-0ubuntu24:25.08.3-0ubuntu14:25.11.80-0ubuntu1 Show 6 moreShow less 4:25.11.90-0ubuntu14:25.12.0-0ubuntu14:25.12.1-0ubuntu14:25.12.1-0ubuntu24:25.12.2-0ubuntu14:25.12.3-0ubuntu1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-19120 is a high vulnerability (CVSS 7.5) in Kde Applications, published November 29, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.46%, the 73rd percentile. Fixed in kio-extras 4:18.08.3-1.

References

Show 6 moreShow less