Description
An issue was discovered in KDE Plasma Workspace before 5.12.0. dataengines/notifications/notificationsengine.cpp allows remote attackers to discover client IP addresses via a URL in a notification, as demonstrated by the src attribute of an IMG element.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | plasma-workspace | 4:5.12.0-2 | — |
| Debian 13 | plasma-workspace | 4:5.12.0-2 | — |
| Debian 12 | plasma-workspace | 4:5.12.0-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | plasma-workspace | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | kdelibs +4 | 6:4.14.8-10.el7 | RHSA-2019:2141 |
| RHEL 7 | kmag | 4.10.5-4.el7 | RHSA-2019:2141 |
| RHEL 7 | kwin +22 | 4.11.19-13.el7 | RHSA-2019:2141 |
| RHEL 7 | qt-settings +5 | 19-23.9.el7 | RHSA-2019:2141 |
| RHEL 7 | virtuoso-opensource +1 | 1:6.1.6-7.el7 | RHSA-2019:2141 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 12 SP3 | plasma5-workspace | 5.8.7-8.1 | openSUSE-SU-2018:0398-1, openSUSE-SU-2018:0397-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | kdelibs +4 | 6:4.14.8-10.el7 | ELSA-2019-2141 |
| Oracle Linux 7 | kmag | 4.10.5-4.el7 | ELSA-2019-2141 |
| Oracle Linux 7 | kwin +22 | 4.11.19-13.el7 | ELSA-2019-2141 |
| Oracle Linux 7 | qt-settings +5 | 19-23.9.0.1.el7 | ELSA-2019-2141 |
| Oracle Linux 7 | virtuoso-opensource +1 | 1:6.1.6-7.el7 | ELSA-2019-2141 |
Advisories 4
- RHSA-2019:2141 Red Hat Security Advisory: kde-workspace security and bug fix update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- openSUSE-SU-2018:0397-1 Security update for plasma5-workspace SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2018:0398-1 Security update for plasma5-workspace SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2019-2141 Low: kde-workspace security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 13, 2019
References
- https://cgit.kde.org/plasma-workspace.git/commit/?id=5bc696b5abcdb460c1017592e80b2d7f6ed3107c
- https://cgit.kde.org/plasma-workspace.git/commit/?id=8164beac15ea34ec0d1564f0557fe3e742bdd938
- https://phabricator.kde.org/D10188
- https://www.kde.org/announcements/plasma-5.11.5-5.12.0-changelog.php
- RHSA-2019:2141 vendor-advisory