CVE-2020-16145: 
Linux Debian vulnerability analysis and mitigation

Roundcube Webmail before versions 1.3.15 and 1.4.8 was affected by a stored Cross-Site Scripting (XSS) vulnerability during message display via a crafted SVG document, identified as CVE-2020-16145. The vulnerability was discovered in July 2020 and publicly disclosed in August 2020. The issue affects Roundcube Webmail's HTML message display functionality (Roundcube Release, Ubuntu Security).

The vulnerability allows for stored XSS attacks through maliciously crafted SVG content in HTML messages. The issue was assigned a CVSS 3.1 Base Score of 6.1 (Medium), with attack vector being Network, attack complexity Low, requiring user interaction, and having a Changed scope. The vulnerability impacts both confidentiality and integrity at Low levels, with no impact on availability (Ubuntu Security).

If exploited, the vulnerability could allow attackers to execute malicious JavaScript code in the context of the victim's browser session when viewing a crafted email message. This could potentially lead to unauthorized access to user data, session hijacking, or other client-side attacks (Debian Security).

The vulnerability requires user interaction, specifically opening a maliciously crafted email message containing SVG content. The attack can be executed remotely through the network, with low attack complexity (Ubuntu Security).

The vulnerability was fixed in Roundcube Webmail versions 1.3.15 and 1.4.8. The fix includes improved sanitization of SVG content in HTML messages. Users are strongly recommended to upgrade to these versions or later. The fix was implemented through commits that enhance the HTML sanitization process (Roundcube Release, Roundcube Release).

The security update was widely distributed through various Linux distributions including Fedora, Ubuntu, and Debian. Credit for discovering the vulnerability was given to Łukasz Pilorz from Pentesters (Roundcube Release).