![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2019\/03\/ios-software-update-available-icon-600x300-e1558142227486.png\"){kind=icon}
Apple released updates today for all of their operating systems and the Safari browser for Mac. Here’s a brief rundown of new features and security related fixes included with each update.<\/p>\nApple released updates today for all of their operating systems and the Safari browser for Mac. Here’s a brief rundown of new features and security related fixes included with each update.<\/p>\n
Apple says that this update introduces a new “iPhone migration” feature, which gives customers the ability to directly transfer data from an old iPhone to a new iPhone wirelessly during the setup process. It also includes enhancements to Apple News, and adds support for HomePod in Japan and Taiwan.<\/p>\n
As usual, this iOS update contains security improvements for all devices that support iOS 12: iPhone 5s and later, iPad Air and later, or iPod touch 6th generation and later. In total, 37 security issues were addressed. A handful of the highlights:<\/p>\n
FaceTime
\n<\/strong>Impact: A remote attacker may be able to cause arbitrary code execution
\nDescription: A memory corruption issue was addressed with improved input validation.<\/p><\/blockquote>\nMessages
\n<\/strong>Impact: A remote attacker may cause an unexpected application termination
\nDescription: A denial of service issue was addressed with improved validation.<\/p><\/blockquote>\nSiri
\n<\/strong>Impact: A remote attacker may be able to leak memory
\nDescription: An out-of-bounds read was addressed with improved input validation.<\/p><\/blockquote>\nTelephony
\n<\/strong>Impact: The initiator of a phone call may be able to cause the recipient to answer a simultaneous Walkie-Talkie connection
\nDescription: A logic issue existed in the answering of phone calls. The issue was addressed with improved state management.<\/p><\/blockquote>\nWallet
\n<\/strong>Impact: A user may inadvertently complete an in-app purchase while on the lock screen
\nDescription: The issue was addressed with improved UI handling.<\/p><\/blockquote>\nOf the 37 fixes, 22 were for WebKit, Apple’s web page rendering engine. All in all, a large amount of CVEs were addressed in this update, so it is recommended to install it sooner rather than later.<\/p>\n
The full list of security issues addressed can be found here<\/a>. iOS 12.4 can be downloaded over the air by going to Settings<\/strong> > General<\/strong> > Software Update<\/strong>. You can also connect your iOS device to your Mac and let iTunes download and install the update for you.<\/p>\n
tvOS 12.4<\/h3>\n
Listed as an update that includes general performance and stability improvements. Available for the Apple TV HD and Apple TV 4K, a total of 32 security issues were addressed, most of which are the same as those addressed in iOS 12.3. Among these fixes, the Kernel, WebKit and Siri all had some work done to make them more secure.<\/p>\n
The full list of security issues addressed can be found here<\/a>. The tvOS update can be downloaded directly to the Apple TV by going to Settings<\/strong> > System\u00a0>\u00a0Software Updates > Check for\u00a0<\/strong>Update<\/strong>.<\/p>\n
Apple TV Software 7.3.1<\/h3>\n
Apple also released a minor update for the Apple TV (3rd generation) containing “general performance and stability improvements.” No new features were listed as part of this update, and Apple’s security updates page<\/a> indicates there are “no published CVE entries<\/span>” related to this update.<\/p>\n
The update can be downloaded directly to the Apple TV by going to Settings<\/strong> > General<\/strong>\u00a0>\u00a0Software Updates<\/strong> >\u00a0Update Software<\/strong>.<\/p>\n
watchOS 5.3<\/h3>\n
Apple says that watchOS 5.3 “includes new features, improvements and bug fixes and is recommended for all users.”\u00a0The most prominent fix is Apple’s reenabling of for the Walkie-Talkie feature, which Apple had disabled two weeks earlier due to a security issue (as discussed on episode 92<\/a> of the Intego Mac Podcast<\/a>).<\/p>\n
The new watchOS update also adds support for two health features for users in Canada and Singapore: the ECG app on Apple Watch Series 4, and irregular heart rhythm notifications.<\/p>\n
A total of 23 security-related issues were fixed, and as you may expect, these are the same as those addressed in iOS and tvOS.<\/p>\n
The new watchOS can be installed by connecting the Apple Watch to its charger, then on the iPhone open the Apple Watch app<\/strong> > My Watch tab<\/strong> > General<\/strong> > Software Update<\/strong>.<\/p>\n
Safari 12.1.2<\/h3>\n
The latest version of Safari for Mac\u2014available for macOS High Sierra and Sierra users, and included with macOS Mojave 10.14.6\u2014brings a few bug fixes and enhancements that improve overall security. A total of 23 security issues were addressed, 22 of which were for WebKit; the remaining issue was in the Safari application itself, and had allowed malicious sites to spoof the address bar.<\/p>\n
The full list of security issues addressed can be found here<\/a>. The new Safari 12.1.2 can be downloaded through the Updates<\/strong> tab of the App Store<\/strong>. For macOS Mojave users it is included in macOS 10.14.6.<\/p>\n
macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra<\/h3>\n
Naturally, macOS received updates as well. Mojave users were treated with both feature and security updates, while High Sierra and Sierra users only received security updates.<\/p>\n
Apple says that the macOS Mojave 10.14.6 update improves the stability and reliability of your Mac, and is recommended for all users. Among the improvements are improvements to Apple News+,\u00a0and fixes related to an issue with Boot Camp on certain Macs with Fusion Drives,\u00a0an issue that may cause a hang during a restart,\u00a0a graphics issue that may occur when waking from sleep,\u00a0an issue that may cause fullscreen video to appear black on Mac mini, and\u00a0file sharing reliability over SMB.<\/p>\n
In total, 44 security related issues were fixed in one or more of the three updates. These include:<\/p>\n
Bluetooth
\n<\/strong>Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.5
\nImpact: A remote attacker may be able to cause arbitrary code execution
\nDescription: A memory corruption issue was addressed with improved input validation.<\/p>\nFaceTime
\n<\/strong>Available for: macOS Mojave 10.14.5
\nImpact: A remote attacker may be able to cause arbitrary code execution
\nDescription: A memory corruption issue was addressed with improved input validation.<\/p>\nGraphics Drivers
\n<\/strong>Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.5
\nImpact: An application may be able to read restricted memory
\nDescription: A validation issue was addressed with improved input sanitization.<\/p>\nTime Machine
\n<\/strong>Available for: macOS Mojave 10.14.5
\nImpact: The encryption status of a Time Machine backup may be incorrect
\nDescription: An inconsistent user interface issue was addressed with improved state management.<\/p>\nSiri
\n<\/strong>Available for: macOS Mojave 10.14.5
\nImpact: A remote attacker may be able to leak memory
\nDescription: An out-of-bounds read was addressed with improved input validation.<\/p><\/blockquote>\nThe full list of security issues addressed can be found here<\/a>. Users of macOS Mojave, High Sierra, and Sierra can install the updates via\u00a0Apple menu<\/strong> > System Preferences…<\/strong> > Software Update<\/strong>.<\/p>\n
iOS 9.3.6 and iOS 10.3.4<\/h3>\n
In an unexpected move, Apple also released updates for iOS 9 and iOS 10, apparently just to address\u00a0GPS and time synchronization issues<\/a>.<\/p>\n
The updates are being made available specifically for GPS-enabled devices that cannot be upgraded to the latest versions of iOS, which includes iPhone 5 and iPad (4th generation) Wi-Fi + Cellular\u2014both of which receive iOS 10.3.4\u2014and iPhone 4s, iPad mini (1st generation) Wi-Fi + Cellular, iPad 2 Wi-Fi + Cellular, and iPad (3rd generation) Wi-Fi + Cellular\u2014all of which receive iOS 9.3.6.<\/p>\n
No update is available for iOS 11 because all devices compatible with iOS 11 are also compatible with iOS 12.<\/p>\n
According to Apple, the updates contain “no published CVE entries,<\/span>” meaning that if any security related issues were addressed, there is no public information about them at this time. It is very important to note that using devices with older versions of iOS is becoming increasingly unsafe<\/strong>; many serious security vulnerabilities have been fixed in iOS 12 that will presumably never be fixed in earlier versions of iOS.<\/p>\n
Anyone still using an older iOS device should therefore consider upgrading to a model that will support iOS 13 or iPadOS 13, which will be released in the fall. The following devices are supposed to be compatible with iOS 13:<\/p>\n
\n
- iPhone SE, iPhone 6s and 6s Plus, iPhone 7 and 7 Plus, iPhone 8 and 8 Plus, iPhone X, iPhone X\u0280, iPhone Xs and Xs Max, and upcoming iPhone models (Apple is expected to release new models this fall around the launch of iOS 13)\n
\n
- Note that iPhone 5s, and iPhone 6 and 6 Plus, will no longer be supported, and presumably won’t receive any more security updates.<\/li>\n<\/ul>\n<\/li>\n
- iPod touch (7th generation)\n
\n
- Note that iPod touch (6th generation) will no longer be supported, and presumably won’t receive any more security updates.<\/li>\n
- Shockingly, this means that if you bought a new iPod touch as recently as May 2019 and just prior to the release of the new 7th-gen model, your device may be as little as 4 months old when Apple will stop releasing security updates for it<\/strong> (as discussed on episode 87<\/a> of the Intego Mac Podcast<\/a>).<\/li>\n<\/ul>\n<\/li>\n
- iPad Air 2, iPad Air (3rd generation), iPad mini 4, iPad mini (5th generation), iPad (5th generation), iPad (6th generation), and all models of iPad Pro\n
\n
- Note that iPad Air, and iPad mini 2 and 3,\u00a0will no longer be supported, and presumably won’t receive any more security updates.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Back up your Macs and iOS devices before updating<\/h3>\n
Whether you’re using iOS or macOS, always back up your data prior to installing any updates. This gives you a restore point in case something does not go as planned. The most thorough way to back up your iOS device is to connect it to your computer and create an encrypted backup via the iTunes app, but you can also back up your device to iCloud as well. For backing up your Mac, see our related article:<\/p>\n
How to Verify Your Backups are Working Properly<\/a><\/p><\/blockquote>\n