SecPod

Learn Search

Search across all Learn content

← Back to Security Research
Apple security updates October 2019

Apple security updates October 2019

Oct 10, 2019By Vidita V Koushik3 min read

Apple released a set of Apple security updates October 2019 for its products this month. There are a total of 24 CVEs which includes the first set of updates for Apple’s new macOS Catalina. Using a vulnerability scanning tool, we can detect these CVE’s.

MacOS Catalina, the latest version of Apple’s desktop operating system was released on October 7. Catalina comes with updated security features to protect the core operating system. MacOS runs in a read-only volume with Catalina, which prevents third-party applications from writing to sensitive parts of the system. With the coming of the new OS, Apple has also withdrawn support for 32-bit applications and the era of Apple iTunes has reached an end. A patch management solution can provide patches for the vulnerabilities.

6 out of 16 vulnerabilities in MacOS Catalina lead to Arbitrary Code Execution. Three vulnerabilities affecting Catalina are considered critical as they allow an attacker to execute arbitrary code with kernel privileges due to memory corruption issues in various components. Catalina was also affected by two browser related issues in the ‘Webkit’ component. While one bug exposed the user’s browsing history, the other bug did not delete the history with ‘Clear History and Website Data’.

Eight vulnerabilities were addressed in Apple iCloud. Six out of eight vulnerabilities lead to Arbitrary Code Execution. Two other vulnerabilities allow an attacker who processes maliciously crafted web content to conduct universal cross site scripting attacks. Also, Apple iTunes received 9 fixes with 7 CVEs addressing arbitrary code execution and 2 CVEs addressing cross site scripting vulnerabilities.

Apple Security Updates Summary :

Apple Security Updates October 2019 has addressed vulnerabilities in the following products:

  • Product : macOS Catalina 10.15
  • Affected OS:  macOS
  • Affected features: AMD, CoreAudio, Crash Reporter, IOGraphics, Intel Graphics Driver, Kernel , Notes, PDFKit, SharedFileList, UIFoundation, WebKit, apache_mod_php, sips
  • Impact : Arbitrary Code Execution, Denial of Service, Information Disclosure
  • CVEs: CVE-2019-11041, CVE-2019-11042, CVE-2019-8701, CVE-2019-8705, CVE-2019-8717, CVE-2019-8730, CVE-2019-8745, CVE-2019-8748, CVE-2019-8755, CVE-2019-8757, CVE-2019-8758, CVE-2019-8768, CVE-2019-8769, CVE-2019-8770, CVE-2019-8772, CVE-2019-8781
  • Product : iCloud for Windows 10.7
  • Affected OS: Windows 10
  • Affected features: UIFoundation, WebKit
  • Impact : Arbitrary Code Execution, Universal Cross Site Scripting
  • CVEs: CVE-2019-8625, CVE-2019-8707, CVE-2019-8719, CVE-2019-8726, CVE-2019-8733, CVE-2019-8735, CVE-2019-8745, CVE-2019-8763
  • Product : iCloud for Windows 7.14
  • Affected OS:  Windows 7 
  • Affected features: UIFoundation, WebKit
  • Impact : Arbitrary Code Execution, Universal Cross Site Scripting
  • CVEs: CVE-2019-8625, CVE-2019-8707, CVE-2019-8719, CVE-2019-8726, CVE-2019-8733, CVE-2019-8735, CVE-2019-8745, CVE-2019-8763
  • Product : iTunes 12.10.1 for Windows
  • Affected OS:  Windows 7
  • Affected features: UIFoundation, WebKit
  • Impact : Arbitrary Code Execution, Universal Cross Site Scripting
  • CVEs: CVE-2019-8625, CVE-2019-8707, CVE-2019-8719, CVE-2019-8720, CVE-2019-8726, CVE-2019-8733, CVE-2019-8735, CVE-2019-8745, CVE-2019-8763

Featured Posts

Open Silent Lynx Hits CIS Governments With WinRAR Flaw
threat intelligenceSilent Lynx Hits CIS Governments With WinRAR Flaw

CVE Research

Silent Lynx Hits CIS Governments With WinRAR Flaw

Silent Lynx (UAT-6275 / TAG-193) is a cyber-espionage actor targeting government organizations across the Commonwealth of Independent States. From June 2025 through August 2026, the group used four infection chains, including macro-enabled documents, PS2EXE downloaders, LNK-based PowerShell loaders, and WinRAR archives that exploit CVE-2025-8088, to deploy custom reverse shells such as FoalShell, Chvost, Laplas, and PickleShell. Activity spans nine countries and focuses on diplomacy, economic development, environmental management, water resources, and energy. This article summarizes the campaign’s delivery methods, infrastructure exposure, indicators of compromise, and practical mitigations for defenders.

Oct 16, 2026

Open Drupal Fixes Critical Field UI Flaw Linked to Remote Code Execution
Drupal Fixes Critical Field UI Flaw Linked to Remote Code Execution

CVE Research

Drupal Fixes Critical Field UI Flaw Linked to Remote Code Execution

A critical vulnerability in Drupal core's Field UI module could allow attackers to execute arbitrary code on vulnerable websites through exposed contributed modules or custom code. Tracked as CVE-2026-108097, the flaw stems from improper validation of PHP callbacks during table rendering. At least one known exploitation path does not require authentication, potentially putting affected websites at risk of server compromise.

Oct 16, 2026

Open Palo Alto PAN-OS Vulnerability CVE-2026-0322 Could Allow Root-Level Code Execution
vulnerability researchPalo Alto PAN-OS Vulnerability CVE-2026-0322 Could Allow Root-Level Code Execution

CVE Research

Palo Alto PAN-OS Vulnerability CVE-2026-0322 Could Allow Root-Level Code Execution

Oct 15, 2026

Open Cisco Secure Email Gateway Under Attack: Critical CVE-2026-76519 Enables Arbitrary File Write
vulnerability researchCisco Secure Email Gateway Under Attack: Critical CVE-2026-76519 Enables Arbitrary File Write

CVE Research

Cisco Secure Email Gateway Under Attack: Critical CVE-2026-76519 Enables Arbitrary File Write

Oct 15, 2026