SecPod

Learn Search

Search across all Learn content

← Back to Security Research

Apple Security Updates December 2019

In the Apple Security Updates December 2019, Apple has rolled out security patches for various products. There are a total of 59 CVEs addressing arbitrary code execution, privilege escalation, information disclosure and denial of service vulnerabilities. Five vulnerabilities in macOS are considered

Dec 13, 20195 min read
Apple Security Updates December 2019
Apple Security Updates December 2019

In the Apple Security Updates December 2019, Apple has rolled out security patches for various products. There are a total of 59 CVEs addressing arbitrary code execution, privilege escalation, information disclosure and denial of service vulnerabilities. Five vulnerabilities in macOS are considered very critical as they allow an attacker to execute arbitrary code with kernel privileges. A vulnerability management tool can stop this from happening.

A majority of the security bugs patched in this release were identified in macOS. Moreover, seven vulnerabilities in macOS could lead to arbitrary code execution, five of which allow arbitrary code execution with kernel privileges. These flaws exist due to out of bounds read and memory corruption issues. Also, the other vulnerabilities in macOS could allow an attacker to read restricted memory, elevate privileges and perform denial of service attacks. Patching these vulnerabilities using a patch management tool is essential.

In Apple Security Updates December 2019, three bugs were resolved in Safari, and all of them could be exploited to execute arbitrary code. However, an attacker could trick a user to visit a malicious website to exploit the underlying vulnerability. Additionally, three vulnerabilities in iCloud and iTunes also lead to arbitrary code execution. Two other flaws in iCloud and iTunes each, allow an attacker to elevate privileges on the target system and also gain access to user information by parsing a maliciously crafted XML file.

Recently, Google discovered an issue in the Intelligent Tracking Prevention (ITP) system included in Safari. Also, the webkit feature was enhanced to handle the loophole. But, no fixes related to this were included in the security updates.

Apple Security Updates Summary :

Apple Security Updates October 2019 has addressed vulnerabilities in the following products:

Product : macOS

  • Affected OS :  macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15
  • Affected features: ATS, Bluetooth, CFNetwork Proxies, CUPS, CallKit, FaceTime, Kernel, OpenLDAP, Security, libexpat and then tcpdump
  • Impact : Arbitrary Code Execution, Privilege Escalation, Information Disclosure, Denial of Service
  • CVEs : CVE-2012-1164, CVE-2012-2668, CVE-2013-4449, CVE-2015-1545, CVE-2017-16808, CVE-2018-10103, CVE-2018-10105, CVE-2018-14461, CVE-2018-14462, CVE-2018-14463, CVE-2018-14464, CVE-2018-14465, CVE-2018-14466, CVE-2018-14467, CVE-2018-14468, CVE-2018-14469, CVE-2018-14470, CVE-2018-14879, CVE-2018-14880, CVE-2018-14881, CVE-2018-14882, CVE-2018-16227, CVE-2018-16228, CVE-2018-16229, CVE-2018-16230, CVE-2018-16300, CVE-2018-16301, CVE-2018-16451, CVE-2018-16452, CVE-2019-13057, CVE-2019-13565, CVE-2019-15161, CVE-2019-15162, CVE-2019-15163, CVE-2019-15164, CVE-2019-15165, CVE-2019-15166, CVE-2019-15167, CVE-2019-15903, CVE-2019-8828, CVE-2019-8830, CVE-2019-8832, CVE-2019-8833, CVE-2019-8837, CVE-2019-8838, CVE-2019-8839, CVE-2019-8842, CVE-2019-8847, CVE-2019-8848, CVE-2019-8852, CVE-2019-8853 and then CVE-2019-8856

Product : iCloud for Windows

  • Affected OS : Windows
  • Affected features: CFNetwork Proxies and then WebKit, libexpat
  • Impact : Arbitrary Code Execution, Elevation of Privilege, Information Disclosure
  • CVEs : CVE-2019-15903, CVE-2019-8835, CVE-2019-8844, CVE-2019-8846 and then CVE-2019-8848
  • Product : iTunes for Windows
  • Affected OS :  Windows
  • Affected features: CFNetwork Proxies and then WebKit, libexpat
  • Impact : Arbitrary Code Execution, Elevation of Privilege, Information Disclosure
  • CVEs : CVE-2019-15903, CVE-2019-8835, CVE-2019-8844, CVE-2019-8846 and then CVE-2019-8848
  • Product : Safari 13.0.4
  • Affected OS :  macOS Mojave and macOS High Sierra, and then included in macOS Catalina
  • Affected features: WebKit
  • Impact : Arbitrary Code Execution
  • CVEs : CVE-2019-8835, CVE-2019-8844 and then CVE-2019-8846
  • Product : Xcode 11.3
  • Affected OS : macOS Mojave
  • Affected features: ld64
  • Impact : Arbitrary Code Execution
  • CVEs : CVE-2019-8840
  • Product : watchOS 5.3.4
  • Affected OS : watchOS
  • Affected features: FaceTime
  • Impact : Arbitrary Code Execution
  • CVEs : CVE-2019-8830
  • Product : watchOS 6.1.1
  • Affected OS :  watchOS
  • Affected features: CFNetwork Proxies, FaceTime, IOUSBDeviceFamily, Kernel, Security, WebKit and then libexpat
  • Impact : Arbitrary Code Execution, Elevation of Privilege, Information Disclosure
  • CVEs : CVE-2019-15903, CVE-2019-8828, CVE-2019-8830, CVE-2019-8832, CVE-2019-8833, CVE-2019-8836, CVE-2019-8838, CVE-2019-8844, CVE-2019-8848 and then CVE-2019-8856
  • Product : tvOS 13.3
  • Affected OS : tvOS
  • Affected features: CFNetwork Proxies, FaceTime, IOUSBDeviceFamily, Kernel, Security, WebKit and then libexpat
  • Impact : Arbitrary Code Execution, Elevation of Privilege, Information Disclosure
  • CVEs : CVE-2019-15903, CVE-2019-8828, CVE-2019-8830, CVE-2019-8832, CVE-2019-8833, CVE-2019-8835, CVE-2019-8836, CVE-2019-8838, CVE-2019-8844, CVE-2019-8846 and then CVE-2019-8848
  • Product : iOS 12.4.4
  • Affected OS :  iOS
  • Affected features: FaceTime
  • Impact : Arbitrary Code Execution
  • CVEs : CVE-2019-8830
  • Product : iOS 13.3 and iPadOS 13.3
  • Affected OS :  iOS and iPadOS
  • Affected features: CFNetwork Proxies, CallKit, FaceTime, IOSurfaceAccelerator, IOUSBDeviceFamily, Kernel, Photos, Security, WebKit and then libexpat
  • Impact : Arbitrary Code Execution, Elevation of Privilege, Information Disclosure
  • CVEs : CVE-2019-15903, CVE-2019-8828, CVE-2019-8830, CVE-2019-8832, CVE-2019-8833, CVE-2019-8835, CVE-2019-8836, CVE-2019-8838, CVE-2019-8841, CVE-2019-8844, CVE-2019-8846, CVE-2019-8848, CVE-2019-8856 and then CVE-2019-8857

Featured Posts

Open Top Vulnerability Scanning Tools 2024

Top Vulnerability Scanning Tools 2024

CVE Research

Top Vulnerability Scanning Tools 2024

According to statistics, a new cyberattack was detected every 39 seconds in 2023! With this rise in number of attacks, protecting sensitive data becomes crucial and challenging. To protect IT, vulnerability scanners are the lead at defense, actively identifying weaknesses within systems and networks

Sep 17, 2026

Open The Webm Zero-Days: All Over The Wild

The Webm Zero-Days: All Over The Wild

CVE Research

The Webm Zero-Days: All Over The Wild

Webmproject, a popular media file format, has been experiencing hardships in security. Two of its libraries, libwebp and libvpx, have been found to contain zero-day vulnerabilities that affect multiple commonly used software products, such as Chrome, Edge, Tor, Telegram, and more! The two notorious

Sep 17, 2026

Open The Ultimate Vulnerability Assessment Checklist

The Ultimate Vulnerability Assessment Checklist

CVE Research

The Ultimate Vulnerability Assessment Checklist

Vulnerability assessment is the process of identifying and assessing vulnerabilities. It makes up for a significant chunk of vulnerability management, and vulnerability management relies heavily on it. Without properly assessing vulnerabilities, your vulnerability management program might fail to me

Sep 17, 2026

Open SCAP Feed Release : 02-Dec-2017

SCAP Feed Release : 02-Dec-2017

CVE Research

SCAP Feed Release : 02-Dec-2017

The following SCAP content has been released to SCAP Repo and SecPod Saner Solution. SecPod Saner will automatically pull the relevant content on its next scheduled update. oval:org.secpod.oval:def:42845 CVE-2017-11293 Out-of-bounds read vulnerability in Adobe Acrobat and Reader products via unspeci

Sep 17, 2026

Apple Security Updates December 2019 | SecPod