CVE-2020-16145

NameCVE-2020-16145
DescriptionRoundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2322-1, DSA-4744-1
NVD severitymedium
Debian Bugs968216

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
roundcube (PTS)stretch1.2.3+dfsg.1-4+deb9u6vulnerable
stretch (security)1.2.3+dfsg.1-4+deb9u8fixed
buster, buster (security)1.3.16+dfsg.1-1~deb10u1fixed
bullseye1.4.11+dfsg.1-3fixed
sid1.4.11+dfsg.1-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
roundcubesourcestretch1.2.3+dfsg.1-4+deb9u7DLA-2322-1
roundcubesourcebuster1.3.15+dfsg.1-1~deb10u1DSA-4744-1
roundcubesource(unstable)1.4.8+dfsg.1-1968216

Notes

https://github.com/roundcube/roundcubemail/commit/a71bf2e8d4a64ff2c83fdabc1e8cb0c045a41ef4 (1.4.8)
https://github.com/roundcube/roundcubemail/commit/d44ca2308a96576b88d6bf27528964d4fe1a6b8b (1.3.15)
https://github.com/roundcube/roundcubemail/commit/589d36010048300ed39f4887aab1afd3ae98d00e (1.2.12)

Search for package or bug name: Reporting problems