CVE-2018-19516
messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0...
messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value.
- Record
CVE-2018-19516- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value.
- Record
CVE-2018-19516- Updated
- 2026-11-02
EUVDEUVD-2018-11205 No score
messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value.
- Record
EUVD-2018-11205- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3j3p-9qrf-3242 No score
messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0...
messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value.
- Record
GHSA-3j3p-9qrf-3242- Updated
- 2026-11-02
OSV
messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value.
- Record
CVE-2018-19516- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-19516
messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value.
- Record
DEBIAN-CVE-2018-19516- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-19516
messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value.
- Record
UBUNTU-CVE-2018-19516- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2018-0476 No score
Updated messagelib packages fix security vulnerability
Some HTML emails can trick messagelib into opening a new browser window when displaying said email as HTML. This happens even if the option to allow the HTML emails to access remote servers is disabled in KMail settings. This means that the owners of the servers referred in the email can see in their access logs your IP address (CVE-2018-19516).
- Record
MGASA-2018-0476- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kf5-messagelibDebian:12 |
before 4:18.08.3-2 | 4:18.08.3-2 |
messagelibMageia:6 |
before 17.12.2-1.1.mga6 | 17.12.2-1.1.mga6 |
kf5-messagelibUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4:17.04.3-0ubuntu14:17.04.3-0ubuntu24:17.08.3-0ubuntu14:17.08.3-0ubuntu24:17.12.2-0ubuntu34:17.12.3-0ubuntu24:17.12.3-0ubuntu34:17.12.3-0ubuntu3+esm1 |
None known |
kf5-messagelibUbuntu:20.04:LTS |
All versions, plus listed versions 4:19.04.3-0ubuntu14:19.04.3-0ubuntu24:19.12.3-0ubuntu1 |
None known |
kf5-messagelibUbuntu:22.04:LTS |
All versions, plus listed versions 4:21.08.1-0ubuntu14:21.08.3-0ubuntu24:21.11.80-0ubuntu14:21.11.90-0ubuntu14:21.12.0-0ubuntu14:21.12.1-0ubuntu14:21.12.2-0ubuntu14:21.12.3-0ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-19516 is a medium vulnerability (CVSS 5.3) in Kde Applications, published December 3, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.10%, the 65th percentile. Fixed in kf5-messagelib 4:18.08.3-2.
References
cgit.kde.org/messagelib.git/commit/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp?id=34765909cdf8e55402a8567b48fb288839c61612
nvd.nist.gov/vuln/detail/CVE-2018-19516
github.com/advisories/GHSA-3j3p-9qrf-3242
security-tracker.debian.org/tracker/CVE-2018-19516
advisories.mageia.org/MGASA-2018-0476.html
bugs.mageia.org/show_bug.cgi?id=23923