Apple’s Latest macOS Catalina 10.15 Fixes Several Security Vulnerabilities, Including Browsing History Leak & Kernel Issues

Apple released macOS Catalina 10.15 last night bringing a slew of new features, including Sidecar, Apple Arcade, Mac Catalyst, and a new Photos experience among other new features and improvements. The company is also incorporating the same Allow/Cancel app access prompts that look exactly what Apple used to diss Microsoft for.

But, new features aside, macOS 10.15 also fixes several security flaws, including some kernel issues and what appears to be a critical vulnerability where visiting a maliciously crafted website can reveal a victim’s browsing history.

Here is the complete macOS Catalina 10.15 security changelog:

AMD

Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2019-8748: Lilang Wu and Moony Li of TrendMicro Mobile Security Research Team

apache_mod_php

Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)

Impact: Multiple issues in PHP

Description: Multiple issues were addressed by updating to PHP version 7.3.8.

CVE-2019-11041

CVE-2019-11042

CoreAudio

Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)

Impact: Processing a maliciously crafted movie may result in the disclosure of process memory

Description: A memory corruption issue was addressed with improved validation.

CVE-2019-8705: riusksk of VulWar Corp working with Trend Micro’s Zero Day Initiative

Crash Reporter

Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)

Impact: The “Share Mac Analytics” setting may not be disabled when a user deselects the switch to share analytics

Description: A race condition existed when reading and writing user preferences. This was addressed with improved state handling.

CVE-2019-8757: William Cerniuk of Core Development, LLC

Intel Graphics Driver

Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2019-8758: Lilang Wu and Moony Li of Trend Micro

IOGraphics

Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)

Impact: A malicious application may be able to determine kernel memory layout

Description: A logic issue was addressed with improved restrictions.

CVE-2019-8755: Lilang Wu and Moony Li of Trend Micro

Kernel

Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2019-8717: Jann Horn of Google Project Zero

Kernel

Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved state management.

CVE-2019-8781: Linus Henze (pinauten.de)

Notes

Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)

Impact: A local user may be able to view a user’s locked notes

Description: The contents of locked notes sometimes appeared in search results. This issue was addressed with improved data cleanup.

CVE-2019-8730: Jamie Blumberg (@jamie_blumberg) of Virginia Polytechnic Institute and State University

PDFKit

Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)

Impact: An attacker may be able to exfiltrate the contents of an encrypted PDF

Description: An issue existed in the handling of links in encrypted PDFs. This issue was addressed by adding a confirmation prompt.

CVE-2019-8772: Jens Müller of Ruhr University Bochum, Fabian Ising of FH Münster University of Applied Sciences, Vladislav Mladenov of Ruhr University Bochum, Christian Mainka of Ruhr University Bochum, Sebastian Schinzel of FH Münster University of Applied Sciences, and Jörg Schwenk of Ruhr University Bochum

SharedFileList

Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)

Impact: A malicious application may be able to access recent documents

Description: The issue was addressed with improved permissions logic.

CVE-2019-8770: Stanislav Zinukhov of Parallels International GmbH

sips

Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2019-8701: Simon Huang(@HuangShaomang), Rong Fan(@fanrong1992) and pjf of IceSword Lab of Qihoo 360

UIFoundation

Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)

Impact: Processing a maliciously crafted text file may lead to arbitrary code execution

Description: A buffer overflow was addressed with improved bounds checking.

CVE-2019-8745: riusksk of VulWar Corp working with Trend Micro’s Zero Day Initiative

WebKit

Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)

Impact: Visiting a maliciously crafted website may reveal browsing history

Description: An issue existed in the drawing of web page elements. The issue was addressed with improved logic.

CVE-2019-8769: Piérre Reimertz (@reimertz)

WebKit

Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)

Impact: A user may be unable to delete browsing history items

Description: “Clear History and Website Data” did not clear the history. The issue was addressed with improved data deletion.

CVE-2019-8768: Hugo S. Diaz (coldpointblue)

The post Apple’s Latest macOS Catalina 10.15 Fixes Several Security Vulnerabilities, Including Browsing History Leak & Kernel Issues by Rafia Shaikh appeared first on Wccftech.

Refference- https://wccftech.com