The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.

Drop -htmlthumbnailer, it has security implications and didn't work all that well.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Albert Astals Cid reports :

Various KDE applications share a plugin system to create thumbnails of various file types for displaying in file managers, file dialogs, etc.
kio-extras contains a thumbnailer plugin for HTML files.

The HTML thumbnailer was incorrectly accessing some content of remote URLs listed in HTML files. This meant that the owners of the servers referred in HTML files in your system could have seen in their access logs your IP address every time the thumbnailer tried to create the thumbnail.

The HTML thumbnailer has been removed in upcoming KDE Applications 18.12.0 because it was actually not creating thumbnails for files at all.

ID	Name	Product	Family	Severity
120321	Fedora 29 : kio-extras (2018-2e64407bef)	Nessus	Fedora Local Security Checks	high
120305	Fedora 28 : kio-extras (2018-27399fd25e)	Nessus	Fedora Local Security Checks	high
119127	Fedora 27 : kio-extras (2018-50eceed44a)	Nessus	Fedora Local Security Checks	high
118900	FreeBSD : kio-extras -- HTML Thumbnailer automatic remote file access (1460aa25-e6ab-11e8-a733-e0d55e2a8bf9)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-19120

high

Tenable Plugins

high

high

high

high