![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2019\/03\/ios-software-update-available-icon-600x300-e1558142227486.png\"){kind=icon}
<\/p>\n<\/p>\n
This week Apple released updates to all of its operating systems and Safari browser. Here’s a brief rundown of new features and security-related fixes included with each update.<\/p>\n
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation<\/p>\n
Apple describes the update’s new features as follows:<\/p>\n
iOS\/iPadOS 13.3 includes improvements, bug fixes and additional parental controls for Screen Time.<\/p><\/blockquote>\n
One of the improvements listed is “Enables the creation of a new video clip when trimming a video in Photos,” which we were able to do before iOS 13, so I’m glad they brought this back.<\/p>\n
Some security related issues were addressed as well: 14, to be exact. Here’s a sampling of some interesting ones:<\/p>\n
FaceTime
\n<\/strong>Impact: Processing malicious video via FaceTime may lead to arbitrary code execution
\nDescription: An out-of-bounds read was addressed with improved input validation.<\/p><\/blockquote>\nPhotos
\n<\/strong>Impact: Live Photo audio and video data may be shared via iCloud links even if Live Photo is disabled in the Share Sheet carousel
\nDescription: The issue was addressed with improved validation when an iCloud Link is created.<\/p><\/blockquote>\nSecurity
\n<\/strong>Impact: An application may be able to execute arbitrary code with system privileges
\nDescription: A memory corruption issue was addressed with improved memory handling.<\/p><\/blockquote>\nCallKit
\n<\/strong>Impact: Calls made using Siri may be initiated using the wrong cellular plan on devices with two active plans
\nDescription: An API issue existed in the handling of outgoing phone calls initiated with Siri. This issue was addressed with improved state handling.<\/p><\/blockquote>\nTwo of the fixes were for WebKit, Apple’s open-source page layout rendering engine, and three of the fixes were for bugs in the kernel, the core component of the operating system.<\/p>\n
The full list of security issues addressed can be found here<\/a>.<\/p>\n
iOS 12.4.4<\/h3>\n
Listed simply as an update that provides important security updates and is recommended for all users, Apple addressed the above mentioned FaceTime issue and apparently nothing else.<\/p>\n
Regardless of whether your device is compatible with iOS 13 or iPadOS, or if it is limited to iOS 12, you can obtain the updates over the air (without tethering to a computer) by going to Settings<\/strong> > General<\/strong> > Software Update<\/strong>. You can also connect your device to your Mac (or Windows PC with iTunes) to install the update.<\/p>\n
tvOS 13.3<\/h3>\n
Apple simply states that tvOS 13.3 includes general performance and stability improvements. Available for the Apple TV HD and Apple TV 4K’s, a total of 11 security issues were addressed. Most of them are the same as those addressed in iOS and iPadOS 13.3. The kernel, WebKit, and even FaceTime all had some work done to make them more secure. The FaceTime issue was addressed because tvOS largely uses the same code as iOS; no FaceTime app for Apple TV exists at this time.<\/p>\n
The full list of security issues addressed can be found here<\/a>. The tvOS update can be downloaded directly from the Apple TV by going to Settings<\/strong> > System<\/strong> > Update Software<\/strong>.<\/p>\n
watchOS 6.1.1<\/h3>\n
Listed as an update that:<\/p>\n
“Provides important security updates and is recommended for all users.”<\/p><\/blockquote>\n
A total of 10 security related issues were fixed and as you’ve come to expect these are the same as the ones addressed in iOS, iPadOS and tvOS.<\/p>\n
The full list of security issues addressed can be found here<\/a>.<\/p>\n
watchOS 5.3.4<\/h3>\n
Listed simply as an update that provides important security updates and is recommended for all users, Apple addressed the above mentioned FaceTime issue and nothing else.<\/p>\n
Apple evidently continues to support watchOS 5 to maintain compatibility with iPhones running iOS 12.<\/p>\n
The watchOS updates can be installed by connecting the watch to its charger, then on the iPhone open the Apple Watch app<\/strong> > My Watch tab<\/strong> > General<\/strong> > Software Update<\/strong>.<\/p>\n
Safari 13.0.4<\/h3>\n
The latest version of Safari, available for macOS High Sierra and Mojave users, brings a few bug fixes and enhancements that improve overall security. Only three security issues were addressed and were all for WebKit.<\/p>\n
The full list of security issues addressed can be found here<\/a>. The new Safari 13.0.4 can be downloaded through the Updates<\/strong> tab of the App Store<\/strong> for High Sierra and through System Preferences<\/strong> > Software Update<\/strong> for Mojave. For macOS Catalina, it is included in macOS 10.15.2.<\/p>\n
macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra<\/h3>\n
Last but not least, macOS received some updates: security-only updates for High Sierra and Mojave and a features-plus-security update for Catalina.<\/p>\n
The macOS Catalina 10.15.2 update includes updates to Apple News, Stocks, Music, Photos, Mail and more, as well as bug fixes and improvements.<\/p><\/blockquote>\n
There are 52 security-related fixes for Catalina, only 5 of which are available for macOS High Sierra and Mojave. A few notable fixes include:<\/p>\n
Bluetooth
\n<\/strong>Impact: An application may be able to read restricted memory
\nDescription: A validation issue was addressed with improved input sanitization.<\/p>\nCUPS
\n<\/strong>Impact: An attacker in a privileged position may be able to perform a denial of service attack
\nDescription: A buffer overflow was addressed with improved bounds checking.<\/p>\nOpenLDAP
\n<\/strong>Impact: Multiple issues in OpenLDAP
\nDescription: Multiple issues were addressed by updating to OpenLDAP version 2.4.28.
\n6 of the 52 fixes are for OpenLDAP<\/p>\ntcpdump
\n<\/strong>Impact: Multiple issues in tcpdump
\nDescription: Multiple issues were addressed by updating to tcpdump version 4.9.3 and libpcap version 1.9.1
\n32 of the 52 fixes are for tcpdump<\/p><\/blockquote>\nThe full list of security issues addressed can be found here<\/a>. macOS High Sierra users can find the security update in the App Store app under the Updates tab. Mojave and Catalina users should visit the Software Update pane in System Preferences (Apple menu<\/strong> > System Preferences…<\/strong> > Software Update<\/strong>) instead.<\/p>\n
Whether you’re using iOS, iPadOS or macOS, always back up your data prior to installing any updates. This gives you a restore point in case something does not go as planned.<\/p>\n
See also our related article on checking your macOS backups:<\/p>\n
How to Verify Your Backups are Working Properly<\/a><\/p><\/blockquote>\n