{"id":"CVE-2018-19120","aliases":["DEBIAN-CVE-2018-19120","EUVD-2018-10833","GHSA-39rp-qwx2-562v","MGASA-2018-0477","UBUNTU-CVE-2018-19120"],"status":"published","title":"The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger...","description":"The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01455,"percentile":0.73647,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2018-11-29T21:00:00Z","modified":"2026-10-23T18:03:03Z","fixes":[{"ecosystem":"Debian:12","package":"kio-extras","fixed_in":["4:18.08.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"kio-extras","fixed_in":["4:18.08.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"kio-extras","fixed_in":["4:18.08.3-1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"kio-extras","fixed_in":["17.12.2-4.1.mga6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"kio-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:18.08.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"kio-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:18.08.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"kio-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:18.08.3-1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"kio-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.12.2-4.1.mga6"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"kde-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:15.08.2-0ubuntu1","4:15.12.1-0ubuntu1","4:15.12.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"kio-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:15.08.2-0ubuntu1","4:15.12.1-1ubuntu1","4:15.12.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"kde-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:17.04.3-0ubuntu1","4:17.08.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"kio-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:17.04.3-0ubuntu1","4:17.08.3-0ubuntu1","4:17.12.2-0ubuntu1","4:17.12.3-0ubuntu1","4:17.12.3-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"kio-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:19.04.3-0ubuntu1","4:19.08.1-1","4:19.08.3-0ubuntu1","4:19.08.3-0ubuntu2","4:19.12.0-0ubuntu1","4:19.12.1-0ubuntu1","4:19.12.2-0ubuntu1","4:19.12.3a-0ubuntu1","4:19.12.3a-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"kio-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:21.08.1-0ubuntu1","4:21.08.3-0ubuntu1","4:21.08.3-1ubuntu1","4:21.11.80-0ubuntu1","4:21.11.90-0ubuntu1","4:21.11.90-0ubuntu2","4:21.12.0-0ubuntu1","4:21.12.1-0ubuntu1","4:21.12.2-0ubuntu1","4:21.12.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"kio-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:23.08.1-0ubuntu1","4:23.08.2-0ubuntu1","4:23.08.3-0ubuntu1","4:23.08.4-0ubuntu1","4:23.08.4-1ubuntu1","4:23.08.5-0ubuntu1","4:23.08.5-0ubuntu3","4:23.08.5-0ubuntu4","4:23.08.5-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"kio-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:24.12.3-0ubuntu1","4:25.04.0-0ubuntu1","4:25.04.1-0ubuntu1","4:25.04.2-0ubuntu1","4:25.04.2-1ubuntu1","4:25.04.3-0ubuntu1","4:25.07.80-0ubuntu1","4:25.07.90-0ubuntu1","4:25.08.0-0ubuntu1","4:25.08.1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"kio-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:25.12.3-0ubuntu1","4:26.04.2-0ubuntu1","4:26.04.3-0ubuntu1","4:26.07.90-0ubuntu1","4:26.08.0-0ubuntu1","4:26.08.1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"kio-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:25.08.1-0ubuntu1","4:25.08.2-0ubuntu1","4:25.08.2-0ubuntu2","4:25.08.3-0ubuntu1","4:25.11.80-0ubuntu1","4:25.11.90-0ubuntu1","4:25.12.0-0ubuntu1","4:25.12.1-0ubuntu1","4:25.12.1-0ubuntu2","4:25.12.2-0ubuntu1","4:25.12.3-0ubuntu1"]}],"products":[{"vendor":"kde","product":"kde_applications"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1649420","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CWRCGXLPJHM4OFD66BINH2FIMYHRCRKF/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19120"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWRCGXLPJHM4OFD66BINH2FIMYHRCRKF/"},{"url":"https://github.com/advisories/GHSA-39rp-qwx2-562v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-19120","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0477.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23868","tags":["report"]},{"url":"https://www.kde.org/info/security/advisory-20181012-1.txt","tags":["advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/CWRCGXLPJHM4OFD66BINH2FIMYHRCRKF/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-19120","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-19120","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-19120","description":"The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.","status":"published","published":"2018-11-29T21:00:00Z","modified":"2024-08-05T11:30:04.037Z","updated_at":"2026-11-02T14:35:02.966615Z"}],"euvd":[{"id":"EUVD-2018-10833","description":"The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.","status":"published","published":"2018-11-29T21:00:00Z","modified":"2024-08-05T11:30:04Z","updated_at":"2026-11-03T02:39:34.247095Z"}],"ghsa":[{"id":"GHSA-39rp-qwx2-562v","title":"The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger...","description":"The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.","status":"published","published":"2022-05-14T01:37:52Z","modified":"2023-02-02T05:04:14Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:51:49.55689Z"}],"nvd":[{"id":"CVE-2018-19120","description":"The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.","status":"published","published":"2018-11-29T21:29:00.353Z","modified":"2026-06-17T01:48:48.497Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:04:48.987926Z"}],"osv":[{"id":"CVE-2018-19120","description":"The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.","status":"published","published":"2018-11-29T21:29:00.353Z","modified":"2026-04-16T06:25:19.767001642Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"DEBIAN-CVE-2018-19120","description":"The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.","status":"published","published":"2018-11-29T21:29:00.353Z","modified":"2026-10-23T18:03:03.360870302Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"UBUNTU-CVE-2018-19120","description":"The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.","status":"published","published":"2018-11-29T21:29:00Z","modified":"2026-10-17T12:55:23.783621579Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"MGASA-2018-0477","title":"Updated kio-extras packages fix security vulnerability","description":"The HTML thumbnailer was incorrectly accessing some content of remote\nURLs listed in HTML files. This meant that the owners of the servers\nreferred in HTML files in your system could have seen in their access\nlogs your IP address every time the thumbnailer tried to create the\nthumbnail (CVE-2018-19120).\n","status":"published","published":"2018-12-06T12:10:17Z","modified":"2026-04-16T06:23:04.231795426Z","updated_at":"2026-11-02T15:49:40.793816Z"}]}}