SecPod

Learn Search

Search across all Learn content

← Back to Security Research

Apple Security Updates December 2019

In the Apple Security Updates December 2019, Apple has rolled out security patches for various products. There are a total of 59 CVEs addressing arbitrary code execution, privilege escalation, information disclosure and denial of service vulnerabilities. Five vulnerabilities in macOS are considered

Dec 13, 20195 min read
Apple Security Updates December 2019
Apple Security Updates December 2019

In the Apple Security Updates December 2019, Apple has rolled out security patches for various products. There are a total of 59 CVEs addressing arbitrary code execution, privilege escalation, information disclosure and denial of service vulnerabilities. Five vulnerabilities in macOS are considered very critical as they allow an attacker to execute arbitrary code with kernel privileges. A vulnerability management tool can stop this from happening.

A majority of the security bugs patched in this release were identified in macOS. Moreover, seven vulnerabilities in macOS could lead to arbitrary code execution, five of which allow arbitrary code execution with kernel privileges. These flaws exist due to out of bounds read and memory corruption issues. Also, the other vulnerabilities in macOS could allow an attacker to read restricted memory, elevate privileges and perform denial of service attacks. Patching these vulnerabilities using a patch management tool is essential.

In Apple Security Updates December 2019, three bugs were resolved in Safari, and all of them could be exploited to execute arbitrary code. However, an attacker could trick a user to visit a malicious website to exploit the underlying vulnerability. Additionally, three vulnerabilities in iCloud and iTunes also lead to arbitrary code execution. Two other flaws in iCloud and iTunes each, allow an attacker to elevate privileges on the target system and also gain access to user information by parsing a maliciously crafted XML file.

Recently, Google discovered an issue in the Intelligent Tracking Prevention (ITP) system included in Safari. Also, the webkit feature was enhanced to handle the loophole. But, no fixes related to this were included in the security updates.

Apple Security Updates Summary :

Apple Security Updates October 2019 has addressed vulnerabilities in the following products:

Product : macOS

  • Affected OS :  macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15
  • Affected features: ATS, Bluetooth, CFNetwork Proxies, CUPS, CallKit, FaceTime, Kernel, OpenLDAP, Security, libexpat and then tcpdump
  • Impact : Arbitrary Code Execution, Privilege Escalation, Information Disclosure, Denial of Service
  • CVEs : CVE-2012-1164, CVE-2012-2668, CVE-2013-4449, CVE-2015-1545, CVE-2017-16808, CVE-2018-10103, CVE-2018-10105, CVE-2018-14461, CVE-2018-14462, CVE-2018-14463, CVE-2018-14464, CVE-2018-14465, CVE-2018-14466, CVE-2018-14467, CVE-2018-14468, CVE-2018-14469, CVE-2018-14470, CVE-2018-14879, CVE-2018-14880, CVE-2018-14881, CVE-2018-14882, CVE-2018-16227, CVE-2018-16228, CVE-2018-16229, CVE-2018-16230, CVE-2018-16300, CVE-2018-16301, CVE-2018-16451, CVE-2018-16452, CVE-2019-13057, CVE-2019-13565, CVE-2019-15161, CVE-2019-15162, CVE-2019-15163, CVE-2019-15164, CVE-2019-15165, CVE-2019-15166, CVE-2019-15167, CVE-2019-15903, CVE-2019-8828, CVE-2019-8830, CVE-2019-8832, CVE-2019-8833, CVE-2019-8837, CVE-2019-8838, CVE-2019-8839, CVE-2019-8842, CVE-2019-8847, CVE-2019-8848, CVE-2019-8852, CVE-2019-8853 and then CVE-2019-8856

Product : iCloud for Windows

  • Affected OS : Windows
  • Affected features: CFNetwork Proxies and then WebKit, libexpat
  • Impact : Arbitrary Code Execution, Elevation of Privilege, Information Disclosure
  • CVEs : CVE-2019-15903, CVE-2019-8835, CVE-2019-8844, CVE-2019-8846 and then CVE-2019-8848
  • Product : iTunes for Windows
  • Affected OS :  Windows
  • Affected features: CFNetwork Proxies and then WebKit, libexpat
  • Impact : Arbitrary Code Execution, Elevation of Privilege, Information Disclosure
  • CVEs : CVE-2019-15903, CVE-2019-8835, CVE-2019-8844, CVE-2019-8846 and then CVE-2019-8848
  • Product : Safari 13.0.4
  • Affected OS :  macOS Mojave and macOS High Sierra, and then included in macOS Catalina
  • Affected features: WebKit
  • Impact : Arbitrary Code Execution
  • CVEs : CVE-2019-8835, CVE-2019-8844 and then CVE-2019-8846
  • Product : Xcode 11.3
  • Affected OS : macOS Mojave
  • Affected features: ld64
  • Impact : Arbitrary Code Execution
  • CVEs : CVE-2019-8840
  • Product : watchOS 5.3.4
  • Affected OS : watchOS
  • Affected features: FaceTime
  • Impact : Arbitrary Code Execution
  • CVEs : CVE-2019-8830
  • Product : watchOS 6.1.1
  • Affected OS :  watchOS
  • Affected features: CFNetwork Proxies, FaceTime, IOUSBDeviceFamily, Kernel, Security, WebKit and then libexpat
  • Impact : Arbitrary Code Execution, Elevation of Privilege, Information Disclosure
  • CVEs : CVE-2019-15903, CVE-2019-8828, CVE-2019-8830, CVE-2019-8832, CVE-2019-8833, CVE-2019-8836, CVE-2019-8838, CVE-2019-8844, CVE-2019-8848 and then CVE-2019-8856
  • Product : tvOS 13.3
  • Affected OS : tvOS
  • Affected features: CFNetwork Proxies, FaceTime, IOUSBDeviceFamily, Kernel, Security, WebKit and then libexpat
  • Impact : Arbitrary Code Execution, Elevation of Privilege, Information Disclosure
  • CVEs : CVE-2019-15903, CVE-2019-8828, CVE-2019-8830, CVE-2019-8832, CVE-2019-8833, CVE-2019-8835, CVE-2019-8836, CVE-2019-8838, CVE-2019-8844, CVE-2019-8846 and then CVE-2019-8848
  • Product : iOS 12.4.4
  • Affected OS :  iOS
  • Affected features: FaceTime
  • Impact : Arbitrary Code Execution
  • CVEs : CVE-2019-8830
  • Product : iOS 13.3 and iPadOS 13.3
  • Affected OS :  iOS and iPadOS
  • Affected features: CFNetwork Proxies, CallKit, FaceTime, IOSurfaceAccelerator, IOUSBDeviceFamily, Kernel, Photos, Security, WebKit and then libexpat
  • Impact : Arbitrary Code Execution, Elevation of Privilege, Information Disclosure
  • CVEs : CVE-2019-15903, CVE-2019-8828, CVE-2019-8830, CVE-2019-8832, CVE-2019-8833, CVE-2019-8835, CVE-2019-8836, CVE-2019-8838, CVE-2019-8841, CVE-2019-8844, CVE-2019-8846, CVE-2019-8848, CVE-2019-8856 and then CVE-2019-8857

Featured Posts

Open WHIPSHOT and SLAPSHOT: Citrix NetScaler Zero-Days Exploited to Plant Root Web Shells and Internal Tunnels
WHIPSHOT and SLAPSHOT: Citrix NetScaler Zero-Days Exploited to Plant Root Web Shells and Internal Tunnels

CVE Research

WHIPSHOT and SLAPSHOT: Citrix NetScaler Zero-Days Exploited to Plant Root Web Shells and Internal Tunnels

Oct 1, 2026

Open OpenSSL’s DTLS State Handling Error Opens the Door to Heap Data Exposure
OpenSSL’s DTLS State Handling Error Opens the Door to Heap Data Exposure

CVE Research

OpenSSL’s DTLS State Handling Error Opens the Door to Heap Data Exposure

Oct 1, 2026

Open Patch Analysis & Exploitation Timeline: Critical WSO2 and Adobe Flaws Show 1-Day vs. 133-Day Exploitation Window , September 24, 2026 KEV Additions
Patch Analysis & Exploitation Timeline: Critical WSO2 and Adobe Flaws Show 1-Day vs. 133-Day Exploitation Window , September 24, 2026 KEV Additions

CVE Research

Patch Analysis & Exploitation Timeline: Critical WSO2 and Adobe Flaws Show 1-Day vs. 133-Day Exploitation Window , September 24, 2026 KEV Additions

Two critical vulnerabilities added to CISA KEV on September 24, 2026 reveal sharply different exploitation timelines. CVE-2026-71362 saw publicly documented exploitation roughly one day after Adobe's patch release, while CVE-2026-5430 had a 133-day vendor-remediation-to-observed-exploitation interval.

Oct 1, 2026

Open Patch Analysis & Exploitation Timeline: Same-Week KEV Additions, Year-Apart Patch Dates - Linux Kernel, September 18, 2026
Patch Analysis & Exploitation Timeline: Same-Week KEV Additions, Year-Apart Patch Dates - Linux Kernel, September 18, 2026

CVE Research

Patch Analysis & Exploitation Timeline: Same-Week KEV Additions, Year-Apart Patch Dates - Linux Kernel, September 18, 2026

Three Linux kernel vulnerabilities entered CISA’s KEV catalog on September 18, 2026, although their Linux 6.12 fixes were available 91–386 days earlier. This analysis separates patch availability, CVE publication, and known-exploitation status without treating KEV dates as first-attack dates.

Sep 28, 2026