![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2019\/03\/ios-software-update-available-icon-600x300-e1558142227486.png\"){kind=icon}
<\/p>\n<\/p>\n
This week Apple released updates to all of its operating systems and Safari browser. Here’s a brief rundown of new features and security-related fixes included with each update.<\/p>\n
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation<\/p>\n
Apple describes the update’s new features as follows:<\/p>\n
Includes bug fixes and improvements. This update:<\/p>\n
\n
- Fixes an issue in Communication Limits that could allow a contact to be added without entering the Screen Time passcode<\/li>\n
- Adds a setting to control the use of location services by the U1 Ultra Wideband chip<\/li>\n
- Addresses an issue that could cause a momentary delay before editing a Deep Fusion photo taken on iPhone 11 or iPhone 11 Pro<\/li>\n
- Resolves an issue with Mail that could cause remote images to load even when the \u201cLoad Remote Images\u201d setting is disabled<\/li>\n
- Fixes an issue that could cause multiple undo dialogs to appear in Mail<\/li>\n
- Addresses an issue where FaceTime could use the rear facing ultra-wide camera instead of the wide camera<\/li>\n
- Resolves an issue where push notifications could fail to be delivered over Wi-Fi<\/li>\n
- Addresses a CarPlay issue that could cause distorted sound when making phone calls in certain vehicles<\/li>\n
- Introduces support for Indian English Siri voices for HomePod.<\/li>\n<\/ul>\n<\/blockquote>\n
Some security related issues were addressed as well: 23, to be exact. Here’s a sampling of some interesting ones:<\/p>\n
FaceTime
\n<\/strong>Impact: A remote FaceTime user may be able to cause the local user’s camera self-view to display the incorrect camera
\nDescription: An issue existed in the handling of the local user’s self-view. The issue was corrected with improved logic.<\/p><\/blockquote>\nImageIO
\n<\/strong>Impact: Processing a maliciously crafted image may lead to arbitrary code execution
\nDescription: An out-of-bounds read was addressed with improved input validation.<\/p><\/blockquote>\n
\n<\/strong>Impact: Turning off “Load remote content in messages\u201d may not apply to all mail previews
\nDescription: This issue was addressed with improved setting propagation.<\/p><\/blockquote>\nScreenshots
\n<\/strong>Impact: Screenshots of the Messages app may reveal additional message content
\nDescription: An issued existed in the naming of screenshots. The issue was corrected with improved naming.<\/p><\/blockquote>\nEight of the fixes were for bugs in the kernel, the core component of the operating system, addressing serious issues such as arbitrary code execution and apps being able to access restricted memory.<\/p>\n
The full list of security issues addressed can be found here<\/a>.<\/p>\n
iOS 12.4.5<\/h3>\n
Listed simply as an update that provides important security updates and is recommended for all users, Apple has not released security notes for this update.<\/p>\n
Regardless of whether your device is compatible with iOS 13 or iPadOS, or if it is limited to iOS 12, you can obtain the updates over the air (without tethering to a computer) by going to Settings<\/strong> > General<\/strong> > Software Update<\/strong>. You can also connect your device to your Mac (or Windows PC with iTunes) to install the update.<\/p>\n
tvOS 13.3.1<\/h3>\n
Apple simply states that tvOS 13.3.1 includes general performance and stability improvements. Available for the Apple TV HD and Apple TV 4K’s, a total of 14 security issues were addressed. Most of them the same as those addressed in iOS and iPadOS 13.3.1. Kernel, ImageIO and Audio all had some work done to make them more secure.<\/p>\n
The full list of security issues addressed can be found here<\/a>. The tvOS update can be downloaded directly from the Apple TV by going to Settings<\/strong> > System<\/strong> > Update Software<\/strong>.<\/p>\n
watchOS 6.1.2<\/h3>\n
Apple says that watchOS 6.1.2 “provides important security updates and is recommended for all users.” A total of 15 security-related issues were fixed, and as you’ve come to expect, these are the same issues addressed in iOS, iPadOS, and tvOS.<\/p>\n
The full list of security issues addressed can be found here<\/a>.<\/p>\n
Safari 13.0.5<\/h3>\n
The latest version of Safari, available for macOS Mojave and High Sierra, brings a few bug fixes and enhancements that improve overall security. Only two security issues were addressed:<\/p>\n
Safari<\/strong>
\nImpact: Visiting a malicious website may lead to address bar spoofing
\nDescription: An inconsistent user interface issue was addressed with improved state management.<\/p>\nSafari Login AutoFill<\/strong>
\nImpact: A local user may unknowingly send a password unencrypted over the network
\nDescription: The issue was addressed with improved UI handling.<\/p><\/blockquote>\nSafari 13.0.5 can be downloaded through the Updates<\/strong> tab of the App Store<\/strong> for High Sierra and through System Preferences<\/strong> > Software Update<\/strong> for Mojave. For macOS Catalina, it is included in macOS 10.15.3.<\/p>\n
macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra<\/h3>\n
Last but not least, macOS received some updates: security-only updates for Mojave and High Sierra, and a bugfix-plus-security update for Catalina:<\/p>\n
\n\nThe macOS Catalina 10.15.3 update improves the stability, reliability, and security of your Mac, and is recommended for all users.<\/p>\n
\n
- Optimizes gamma handling of low gray levels on Pro Display XDR for SDR workflows when using macOS<\/li>\n
- Improves multi-stream video editing performance for HEVC and H.264-encoded 4K video on the MacBook Pro (16-inch, 2019)<\/li>\n<\/ul>\n<\/div>\n<\/blockquote>\n
There were 32 security related fixes included for macOS Catalina, but only 17 of them are available for Mojave and High Sierra. Some of the more interesting updates include:<\/p>\n
autofs
\n<\/strong>Available for: macOS Catalina 10.15.2
\nImpact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper
\nDescription: This was addressed with additional checks by Gatekeeper on files mounted through a network share.<\/p>\nsudo
\n<\/strong>Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
\n<\/strong>Impact: Certain configurations may allow a local attacker to execute arbitrary code
\nDescription: A buffer overflow issue was addressed with improved memory handling.<\/p>\nWi-Fi
\n<\/strong>Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
\n<\/strong>Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory
\nDescription: A memory corruption issue was addressed with improved input validation.<\/p>\nImage Processing
\n<\/strong>Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
\n<\/strong>Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution
\nDescription: A memory corruption issue was addressed with improved input validation.<\/p><\/blockquote>\nThe full list of security issues addressed can be found here<\/a>. macOS High Sierra users can find the security update in the App Store app under the Updates tab. Mojave and Catalina users should visit the Software Update pane in System Preferences (Apple menu<\/strong> > System Preferences…<\/strong> > Software Update<\/strong>) instead. Standalone updates can also be downloaded from the following links:<\/p>\n
\n
- Catalina 10.15.3<\/a><\/li>\n
- Catalina 10.15.3 Combo Update<\/a><\/li>\n
- Security Update 2020-001<\/a>\u00a0(Mojave)<\/li>\n
- Security Update 2020-001<\/a> (High Sierra)<\/li>\n<\/ul>\n
Whether you’re using iOS, iPadOS, or macOS, always back up your data prior to installing any updates. This gives you a restore point in case something does not go as planned.<\/p>\n
See also our related article on checking your macOS backups:<\/p>\n
How to Verify Your Backups are Working Properly<\/a><\/p><\/blockquote>\n