PT-2019-15541 · Opera · Opera Mini For Android

Published 2019-10-29 · Updated 2021-07-21 · CVE-2019-18624

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Opera Mini for Android versions 44.1.2254.142553 through 44.1.2254.143214

Description The issue allows attackers to bypass intended restrictions on .apk file download/installation via an RTLO (Right to Left Override) approach. This can be demonstrated by the misinterpretation of a malicious .apk file, such as malicious%E2%80%AEtxt.apk being misinterpreted as maliciouskpa.txt.

Recommendations For versions 44.1.2254.142553 through 44.1.2254.143214, update to a version that contains a fix for this issue to prevent the bypassing of restrictions on .apk file download/installation.

Exploit

Fix

Related Identifiers

CVE-2019-18624

Affected Products

Opera Mini For Android

References · 5

• 🔥 http://firstsight.me/2019/10/illegal-rendered-at-download-feature-in-several-apps-including-opera-mini-that-lead-to-extension-manipulation-with-rtlo · Exploit
• 🔥 https://medium.com/@YoKoKho/illegal-rendered-at-download-feature-in-opera-mini-that-lead-to-extension-manipulation-with-rtlo-685bf2d77d51 · Exploit
• https://osv.dev/vulnerability/CVE-2019-18624 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18624 · Security Note
• https://medium.com/%40YoKoKho/illegal-rendered-at-download-feature-in-opera-mini-that-lead-to-extension-manipulation-with-rtlo-685bf2d77d51 · Note