SecPod

Learn Search

Search across all Learn content

← Back to Security Research

Apple Security Updates July 2019

Apple released a set of Apple security updates July 2019 to address vulnerabilities in its various products. About 49 vulnerabilities were identified and fixed by Apple in these security updates. Out of the 49, 44 CVEs were relevant to MacOS, while 23 CVEs were reported for iCloud, Safari, and iTune

Jul 24, 20197 min read

Apple released a set of Apple security updates July 2019 to address vulnerabilities in its various products. About 49 vulnerabilities were identified and fixed by Apple in these security updates.  Out of the 49, 44 CVEs were relevant to MacOS, while 23 CVEs were reported for iCloud, Safari, and iTunes each. And 29 flaws are considered severe and could be exploited to execute arbitrary code.

22 out of the 44 flaws reported for MacOS were present in the WebKit component alone. There were 26 memory corruption flaws in macOS which allow arbitrary code execution.  CVE-2019-8694 in the IOAcceleratorFamily affecting only MacOS is considered critical as it can lead to arbitrary code execution with kernel privileges. There are no reports of these vulnerabilities exploited in the wild.

These are the arbitrary code execution flaws which are considered severe and administrators are advised to install the updates for these vulnerabilities at the earliest:

CVE-2018-19860, CVE-2019-8641, CVE-2019-8644, CVE-2019-8647, CVE-2019-8648, CVE-2019-8657, CVE-2019-8660, CVE-2019-8661, CVE-2019-8666, CVE-2019-8669, CVE-2019-8671, CVE-2019-8672, CVE-2019-8673, CVE-2019-8676, CVE-2019-8677, CVE-2019-8678, CVE-2019-8679, CVE-2019-8680, CVE-2019-8681, CVE-2019-8683, CVE-2019-8684, CVE-2019-8685, CVE-2019-8686, CVE-2019-8687, CVE-2019-8688, CVE-2019-8689, CVE-2019-8694, CVE-2019-8695, CVE-2019-8697

Apple released silent updates earlier this month to protect its customers from the Zoom zero-day. Apple Safari was updated recently to not open up third party applications without confirmation from the user. Zoom had a web server functionality to get around Safari’s security feature to provide a seamless experience to its users. This web server functionality allowed malicious websites with an iframe to launch a video call on Mac with the camera on. Apple’s silent updates helped in disabling the web server installed by Zoom. This update was particularly helpful to those users who had uninstalled Zoom but the webserver was still server running on the machines making them vulnerable. This update does not need user interaction and is deployed automatically.

Apple Security Updates Summary :

Apple Security Updates July 2019 has addressed vulnerabilities in the following products:

  • Product : MacOS
  • Affected OS : macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.5
  • Affected features: AppleGraphicsControl, autofs, Bluetooth, Carbon Core, Core Data, Disk Management, FaceTime, Foundation, Grapher, Graphics Drivers, Heimdal, IOAcceleratorFamily, libxslt, Quick Look, Safari, Security, Siri, Time Machine, UIFoundation, WebKit, Found in Apps
  • Impact : Arbitrary code execution, Information disclosure, Denial of Service, Address bar spoofing, Deserialization of untrusted data, Universal cross site scripting, Gatekeeper bypass
  • CVEs: CVE-2019-8693, CVE-2019-8656, CVE-2018-19860, CVE-2019-8661, CVE-2019-8646, CVE-2019-8660, CVE-2019-8697, CVE-2019-8648, CVE-2019-8663, CVE-2019-8641, CVE-2019-8695, CVE-2019-8691, CVE-2019-8692, CVE-2018-16860, CVE-2019-8694, CVE-2019-13118, CVE-2019-8662, CVE-2019-8670, CVE-2019-8697, CVE-2019-8646, CVE-2019-8667, CVE-2019-8657, CVE-2019-8690, CVE-2019-8649, CVE-2019-8658, CVE-2019-8644, CVE-2019-8666, CVE-2019-8669, CVE-2019-8671, CVE-2019-8672, CVE-2019-8673, CVE-2019-8676, CVE-2019-8677, CVE-2019-8678, CVE-2019-8679, CVE-2019-8680, CVE-2019-8681, CVE-2019-8683, CVE-2019-8684, CVE-2019-8685, CVE-2019-8686, CVE-2019-8687, CVE-2019-8688, CVE-2019-8689
  • Product : Safari 12.1.2
  • Affected OS : macOS Sierra 10.12.6, macOS High Sierra 10.13.6, and included in macOS Mojave 10.14.6
  • Affected features: Safari, WebKit
  • Impact : Address bar spoofing, Universal cross site scripting, Arbitrary code execution
  • CVEs : CVE-2019-8670, CVE-2019-8658, CVE-2019-8690, CVE-2019-8644, CVE-2019-8666, CVE-2019-8669, CVE-2019-8671, CVE-2019-8672, CVE-2019-8673, CVE-2019-8676, CVE-2019-8677, CVE-2019-8678, CVE-2019-8679, CVE-2019-8680, CVE-2019-8681, CVE-2019-8683, CVE-2019-8684, CVE-2019-8685, CVE-2019-8686, CVE-2019-8687, CVE-2019-8688, CVE-2019-8689, CVE-2019-8649
  • Product : iTunes 12.9.6
  • Affected OS : Windows 7 and later
  • Affected features: libxslt, WebKit
  • Impact : Universal cross site scripting, Arbitrary code execution, Information disclosure
  • CVEs : CVE-2019-13118, CVE-2019-8658, CVE-2019-8690, CVE-2019-8644, CVE-2019-8666, CVE-2019-8669, CVE-2019-8671, CVE-2019-8672, CVE-2019-8673, CVE-2019-8676, CVE-2019-8677, CVE-2019-8678, CVE-2019-8679, CVE-2019-8680, CVE-2019-8681, CVE-2019-8683, CVE-2019-8684, CVE-2019-8685, CVE-2019-8686, CVE-2019-8687, CVE-2019-8688, CVE-2019-8689, CVE-2019-8649
  • Product : iCloud for Windows 10.6
  • Affected OS : Windows 10 and later
  • Affected features: libxslt, WebKit
  • Impact : Universal cross site scripting, Arbitrary code execution, Information disclosure
  • CVEs : CVE-2019-13118, CVE-2019-8658, CVE-2019-8690, CVE-2019-8644, CVE-2019-8666, CVE-2019-8669, CVE-2019-8671, CVE-2019-8672, CVE-2019-8673, CVE-2019-8676, CVE-2019-8677, CVE-2019-8678, CVE-2019-8679, CVE-2019-8680, CVE-2019-8681, CVE-2019-8683, CVE-2019-8684, CVE-2019-8685, CVE-2019-8686, CVE-2019-8687, CVE-2019-8688, CVE-2019-8689, CVE-2019-8649
  • Product : iCloud for Windows 7.13
  • Affected OS : Windows 7 and later
  • Affected features: libxslt, WebKit
  • Impact : Universal cross site scripting, Arbitrary code execution, Information disclosure
  • CVEs : CVE-2019-13118, CVE-2019-8658, CVE-2019-8690, CVE-2019-8644, CVE-2019-8666, CVE-2019-8669, CVE-2019-8671, CVE-2019-8672, CVE-2019-8673, CVE-2019-8676, CVE-2019-8677, CVE-2019-8678, CVE-2019-8679, CVE-2019-8680, CVE-2019-8681, CVE-2019-8683, CVE-2019-8684, CVE-2019-8685, CVE-2019-8686, CVE-2019-8687, CVE-2019-8688, CVE-2019-8689, CVE-2019-8649
  • Product : iOS
  • Affected OS : iOS 12.4
  • Affected features: Core Data, FaceTime, Foundation, Heimdal, libxslt, Messages, Profiles, Quick Look, Siri, Telephony, UIFoundation, Wallet, WebKit, Found in Apps
  • Impact : Arbitrary code execution, Information disclosure, Denial of Service, Address bar spoofing, Deserialization of untrusted data, Universal cross site scripting
  • CVEs : CVE-2019-8646, CVE-2019-8647, CVE-2019-8660, CVE-2019-8648, CVE-2019-8663, CVE-2019-8641, CVE-2018-16860, CVE-2019-13118, CVE-2019-8665, CVE-2019-8698, CVE-2019-8662, CVE-2019-8646, CVE-2019-8699, CVE-2019-8657, CVE-2019-8682, CVE-2019-8690, CVE-2019-8649, CVE-2019-8658, CVE-2019-8644, CVE-2019-8666, CVE-2019-8669, CVE-2019-8671, CVE-2019-8672, CVE-2019-8673, CVE-2019-8676, CVE-2019-8677, CVE-2019-8678, CVE-2019-8679, CVE-2019-8680, CVE-2019-8681, CVE-2019-8683, CVE-2019-8684, CVE-2019-8685, CVE-2019-8686, CVE-2019-8687, CVE-2019-8688, CVE-2019-8689
  • Product : tvOS 12.4
  • Affected OS : Apple TV 4K and Apple TV HD
  • Affected features: Core Data, Foundation, Heimdal, Profiles, Quick Look, Siri, UIFoundation, WebKit, libxslt
  • Impact : Arbitrary code execution, Information disclosure, Denial of Service, Universal cross site scripting
  • CVEs : CVE-2019-8646, CVE-2019-8647, CVE-2019-8660, CVE-2019-8641, CVE-2018-16860, CVE-2019-13118, CVE-2019-8698, CVE-2019-8662, CVE-2019-8646, CVE-2019-8657, CVE-2019-8690, CVE-2019-8649, CVE-2019-8658, CVE-2019-8644, CVE-2019-8666, CVE-2019-8669, CVE-2019-8671, CVE-2019-8672, CVE-2019-8673, CVE-2019-8676, CVE-2019-8677, CVE-2019-8678, CVE-2019-8679, CVE-2019-8680, CVE-2019-8681, CVE-2019-8683, CVE-2019-8684, CVE-2019-8685, CVE-2019-8686, CVE-2019-8687, CVE-2019-8688, CVE-2019-8689
  • Product : watchOS
  • Affected OS : watchOS 5.3
  • Affected features: Core Data, Digital Touch, FaceTime, Foundation, Heimdal, Messages, Quick Look, Siri, UIFoundation, Wallet, WebKit, libxslt
  • Impact : Arbitrary code execution, Information disclosure, Denial of Service, Universal cross site scripting
  • CVEs : CVE-2019-8646, CVE-2019-8647, CVE-2019-8660, CVE-2019-8624, CVE-2019-8648, CVE-2019-8641, CVE-2018-16860, CVE-2019-13118, CVE-2019-8659, CVE-2019-8665, CVE-2019-8662, CVE-2019-8646, CVE-2019-8657, CVE-2019-8682, CVE-2019-8658, CVE-2019-8669, CVE-2019-8672, CVE-2019-8676, CVE-2019-8683, CVE-2019-8684, CVE-2019-8685, CVE-2019-8688, CVE-2019-8689

Featured Posts

Open Top Vulnerability Scanning Tools 2024

Top Vulnerability Scanning Tools 2024

CVE Research

Top Vulnerability Scanning Tools 2024

According to statistics, a new cyberattack was detected every 39 seconds in 2023! With this rise in number of attacks, protecting sensitive data becomes crucial and challenging. To protect IT, vulnerability scanners are the lead at defense, actively identifying weaknesses within systems and networks

Sep 17, 2026

Open The Webm Zero-Days: All Over The Wild

The Webm Zero-Days: All Over The Wild

CVE Research

The Webm Zero-Days: All Over The Wild

Webmproject, a popular media file format, has been experiencing hardships in security. Two of its libraries, libwebp and libvpx, have been found to contain zero-day vulnerabilities that affect multiple commonly used software products, such as Chrome, Edge, Tor, Telegram, and more! The two notorious

Sep 17, 2026

Open The Ultimate Vulnerability Assessment Checklist

The Ultimate Vulnerability Assessment Checklist

CVE Research

The Ultimate Vulnerability Assessment Checklist

Vulnerability assessment is the process of identifying and assessing vulnerabilities. It makes up for a significant chunk of vulnerability management, and vulnerability management relies heavily on it. Without properly assessing vulnerabilities, your vulnerability management program might fail to me

Sep 17, 2026

Open SCAP Feed Release : 02-Dec-2017

SCAP Feed Release : 02-Dec-2017

CVE Research

SCAP Feed Release : 02-Dec-2017

The following SCAP content has been released to SCAP Repo and SecPod Saner Solution. SecPod Saner will automatically pull the relevant content on its next scheduled update. oval:org.secpod.oval:def:42845 CVE-2017-11293 Out-of-bounds read vulnerability in Adobe Acrobat and Reader products via unspeci

Sep 17, 2026

Apple Security Updates July 2019 | SecPod