SecPod

Learn Search

Search across all Learn content

← Back to Security Research

Apple Security Updates December 2019

In the Apple Security Updates December 2019, Apple has rolled out security patches for various products. There are a total of 59 CVEs addressing arbitrary code execution, privilege escalation, information disclosure and denial of service vulnerabilities. Five vulnerabilities in macOS are considered

Dec 13, 20195 min read
Apple Security Updates December 2019
Apple Security Updates December 2019

In the Apple Security Updates December 2019, Apple has rolled out security patches for various products. There are a total of 59 CVEs addressing arbitrary code execution, privilege escalation, information disclosure and denial of service vulnerabilities. Five vulnerabilities in macOS are considered very critical as they allow an attacker to execute arbitrary code with kernel privileges. A vulnerability management tool can stop this from happening.

A majority of the security bugs patched in this release were identified in macOS. Moreover, seven vulnerabilities in macOS could lead to arbitrary code execution, five of which allow arbitrary code execution with kernel privileges. These flaws exist due to out of bounds read and memory corruption issues. Also, the other vulnerabilities in macOS could allow an attacker to read restricted memory, elevate privileges and perform denial of service attacks. Patching these vulnerabilities using a patch management tool is essential.

In Apple Security Updates December 2019, three bugs were resolved in Safari, and all of them could be exploited to execute arbitrary code. However, an attacker could trick a user to visit a malicious website to exploit the underlying vulnerability. Additionally, three vulnerabilities in iCloud and iTunes also lead to arbitrary code execution. Two other flaws in iCloud and iTunes each, allow an attacker to elevate privileges on the target system and also gain access to user information by parsing a maliciously crafted XML file.

Recently, Google discovered an issue in the Intelligent Tracking Prevention (ITP) system included in Safari. Also, the webkit feature was enhanced to handle the loophole. But, no fixes related to this were included in the security updates.

Apple Security Updates Summary :

Apple Security Updates October 2019 has addressed vulnerabilities in the following products:

Product : macOS

  • Affected OS :  macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15
  • Affected features: ATS, Bluetooth, CFNetwork Proxies, CUPS, CallKit, FaceTime, Kernel, OpenLDAP, Security, libexpat and then tcpdump
  • Impact : Arbitrary Code Execution, Privilege Escalation, Information Disclosure, Denial of Service
  • CVEs : CVE-2012-1164, CVE-2012-2668, CVE-2013-4449, CVE-2015-1545, CVE-2017-16808, CVE-2018-10103, CVE-2018-10105, CVE-2018-14461, CVE-2018-14462, CVE-2018-14463, CVE-2018-14464, CVE-2018-14465, CVE-2018-14466, CVE-2018-14467, CVE-2018-14468, CVE-2018-14469, CVE-2018-14470, CVE-2018-14879, CVE-2018-14880, CVE-2018-14881, CVE-2018-14882, CVE-2018-16227, CVE-2018-16228, CVE-2018-16229, CVE-2018-16230, CVE-2018-16300, CVE-2018-16301, CVE-2018-16451, CVE-2018-16452, CVE-2019-13057, CVE-2019-13565, CVE-2019-15161, CVE-2019-15162, CVE-2019-15163, CVE-2019-15164, CVE-2019-15165, CVE-2019-15166, CVE-2019-15167, CVE-2019-15903, CVE-2019-8828, CVE-2019-8830, CVE-2019-8832, CVE-2019-8833, CVE-2019-8837, CVE-2019-8838, CVE-2019-8839, CVE-2019-8842, CVE-2019-8847, CVE-2019-8848, CVE-2019-8852, CVE-2019-8853 and then CVE-2019-8856

Product : iCloud for Windows

  • Affected OS : Windows
  • Affected features: CFNetwork Proxies and then WebKit, libexpat
  • Impact : Arbitrary Code Execution, Elevation of Privilege, Information Disclosure
  • CVEs : CVE-2019-15903, CVE-2019-8835, CVE-2019-8844, CVE-2019-8846 and then CVE-2019-8848
  • Product : iTunes for Windows
  • Affected OS :  Windows
  • Affected features: CFNetwork Proxies and then WebKit, libexpat
  • Impact : Arbitrary Code Execution, Elevation of Privilege, Information Disclosure
  • CVEs : CVE-2019-15903, CVE-2019-8835, CVE-2019-8844, CVE-2019-8846 and then CVE-2019-8848
  • Product : Safari 13.0.4
  • Affected OS :  macOS Mojave and macOS High Sierra, and then included in macOS Catalina
  • Affected features: WebKit
  • Impact : Arbitrary Code Execution
  • CVEs : CVE-2019-8835, CVE-2019-8844 and then CVE-2019-8846
  • Product : Xcode 11.3
  • Affected OS : macOS Mojave
  • Affected features: ld64
  • Impact : Arbitrary Code Execution
  • CVEs : CVE-2019-8840
  • Product : watchOS 5.3.4
  • Affected OS : watchOS
  • Affected features: FaceTime
  • Impact : Arbitrary Code Execution
  • CVEs : CVE-2019-8830
  • Product : watchOS 6.1.1
  • Affected OS :  watchOS
  • Affected features: CFNetwork Proxies, FaceTime, IOUSBDeviceFamily, Kernel, Security, WebKit and then libexpat
  • Impact : Arbitrary Code Execution, Elevation of Privilege, Information Disclosure
  • CVEs : CVE-2019-15903, CVE-2019-8828, CVE-2019-8830, CVE-2019-8832, CVE-2019-8833, CVE-2019-8836, CVE-2019-8838, CVE-2019-8844, CVE-2019-8848 and then CVE-2019-8856
  • Product : tvOS 13.3
  • Affected OS : tvOS
  • Affected features: CFNetwork Proxies, FaceTime, IOUSBDeviceFamily, Kernel, Security, WebKit and then libexpat
  • Impact : Arbitrary Code Execution, Elevation of Privilege, Information Disclosure
  • CVEs : CVE-2019-15903, CVE-2019-8828, CVE-2019-8830, CVE-2019-8832, CVE-2019-8833, CVE-2019-8835, CVE-2019-8836, CVE-2019-8838, CVE-2019-8844, CVE-2019-8846 and then CVE-2019-8848
  • Product : iOS 12.4.4
  • Affected OS :  iOS
  • Affected features: FaceTime
  • Impact : Arbitrary Code Execution
  • CVEs : CVE-2019-8830
  • Product : iOS 13.3 and iPadOS 13.3
  • Affected OS :  iOS and iPadOS
  • Affected features: CFNetwork Proxies, CallKit, FaceTime, IOSurfaceAccelerator, IOUSBDeviceFamily, Kernel, Photos, Security, WebKit and then libexpat
  • Impact : Arbitrary Code Execution, Elevation of Privilege, Information Disclosure
  • CVEs : CVE-2019-15903, CVE-2019-8828, CVE-2019-8830, CVE-2019-8832, CVE-2019-8833, CVE-2019-8835, CVE-2019-8836, CVE-2019-8838, CVE-2019-8841, CVE-2019-8844, CVE-2019-8846, CVE-2019-8848, CVE-2019-8856 and then CVE-2019-8857

Featured Posts

Open Critical Apache HTTP/2 RCE Flaw Lets Unauthenticated Attackers Take Full Control of the Server
vulnerability researchCritical Apache HTTP/2 RCE Flaw Lets Unauthenticated Attackers Take Full Control of the Server

CVE Research

Critical Apache HTTP/2 RCE Flaw Lets Unauthenticated Attackers Take Full Control of the Server

CVE-2026-119618 is a critical race-condition vulnerability in Apache HTTP Server’s mod_http2 that can lead to unauthenticated remote code execution when HTTP/2 is enabled. Versions 2.4.55 through 2.4.70 are affected and fixed in 2.4.71. Only hosts that negotiate h2 or h2c are exposed. This article covers how the flaw works, distribution fixes, temporary Protocols mitigation, and related issues in the same release.

Nov 12, 2026

Open Microsoft’s November 2026 Patch Tuesday: 1,093 Vulnerabilities, 63 Critical Fixes, and an Outlook Threat
Microsoft’s November 2026 Patch Tuesday: 1,093 Vulnerabilities, 63 Critical Fixes, and an Outlook Threat

CVE Research

Microsoft’s November 2026 Patch Tuesday: 1,093 Vulnerabilities, 63 Critical Fixes, and an Outlook Threat

Microsoft’s November 2026 Patch Tuesday addresses 1,093 security vulnerabilities, including 63 Critical flaws and an actively exploited Outlook zero-day. The updates tackle serious remote code execution, privilege escalation, and information disclosure vulnerabilities across Windows, Exchange Server, SharePoint, Azure, and other Microsoft products. Explore the most critical flaws, affected products, and essential remediation steps to secure your systems.

Nov 11, 2026

Open Beyond GitLab's Critical RCE: What CVE-2026-97229 Reveals About Exploitation, Patch Gaps, and Security Response
vulnerability researchBeyond GitLab's Critical RCE: What CVE-2026-97229 Reveals About Exploitation, Patch Gaps, and Security Response

CVE Research

Beyond GitLab's Critical RCE: What CVE-2026-97229 Reveals About Exploitation, Patch Gaps, and Security Response

Nov 6, 2026

Open Gorbag Targets Ukrainian Organizations with BeautyStealer and WinRAR Exploitation
malware researchGorbag Targets Ukrainian Organizations with BeautyStealer and WinRAR Exploitation

CVE Research

Gorbag Targets Ukrainian Organizations with BeautyStealer and WinRAR Exploitation

Gorbag uses spearphishing and weaponized WinRAR archives to deploy BeautyStealer against Ukrainian organizations. The malware steals browser credentials, VPN configuration files, and targeted documents before exfiltrating the data and deleting itself.

Nov 5, 2026