- Macos Avast
- Avast Security For Mac With Mac Catalina 2016
- Avast Security For Mac With Mac Catalina 2016
Avast Security (for Mac), AVG AntiVirus for Mac, Avira Free Antivirus for Mac, and Sophos Home Free (for Mac) are totally free for personal use, although Sophos technically limits you to three devices, macOS or Windows. AVG also offers free antivirus for Mac, but until its phishing protection improves, we can't recommend it. Nov 25, 2019 Mac antivirus products come in two main flavors. Some focus solely on the Mac platform, while others, like Norton 360 Deluxe (for Mac), are simply the macOS manifestation of a multi-platform product. Avast Security is a free antivirus that stops malware & finds Wi-Fi security weaknesses. Free Download! Avast Security for Mac Think different about Mac security. Top Best Antivirus for Mac Machine: No Matter – MacBook Pro, MacBook Air #1. Avast Antivirus Program. Avast Mac security available for free also on your Mac devices: MacBook Pro, MacBook Air, and retina.One-click download and easy installation put it on #1 position in the list of the Best Antivirus for Mac.
Oct 07, 2019 About the security content of macOS Catalina 10.15. This document describes the security content of macOS Catalina 10.15. About Apple security updates. Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all. Dec 16, 2019 Get: Norton Security #4. Avast Security for Mac. Avast security leads in the category of best free antivirus for macOS Mojave. All the basic features like home network scans, scheduled scans, antivirus and protection of web, files and more.
The safest place to get apps for your Mac is the App Store. Apple reviews each app in the App Store before it’s accepted and signs it to ensure that it hasn’t been tampered with or altered. If there’s ever a problem with an app, Apple can quickly remove it from the store.
If you download and install apps from the internet or directly from a developer, macOS continues to protect your Mac. When you install Mac apps, plug-ins, and installer packages from outside the App Store, macOS checks the Developer ID signature to verify that the software is from an identified developer and that it has not been altered. By default, macOS Catalina also requires software to be notarized, so you can be confident that the software you run on your Mac doesn't contain known malware. Before opening downloaded software for the first time, macOS requests your approval to make sure you aren’t misled into running software you didn’t expect.
Running software that hasn’t been signed and notarized may expose your computer and personal information to malware that can harm your Mac or compromise your privacy.
View the app security settings on your Mac
By default, the security and privacy preferences of your Mac are set to allow apps from the App Store and identified developers. For additional security, you can chose to allow only apps from the App Store.
In System Preferences, click Security & Privacy, then click General. Click the lock and enter your password to make changes. Select App Store under the header “Allow apps downloaded from.”
Open a developer-signed or notarized app
If your Mac is set to allow apps from the App Store and identified developers, the first time that you launch a new app, your Mac asks if you’re sure you want to open it.
An app that has been notarized by Apple indicates that Apple checked it for malicious software and none was detected:
Prior to macOS Catalina, opening an app that hasn't been notarized shows a yellow warning icon and asks if you're sure you want to open it:
If you see a warning message and can’t install an app
If you have set your Mac to allow apps only from the App Store and you try to install an app from elsewhere, your Mac will say that the app can't be opened because it was not downloaded from the App Store.*
If your Mac is set to allow apps from the App Store and identified developers, and you try to install an app that isn’t signed by an identified developer or—in macOS Catalina—notarized by Apple, you also see a warning that the app cannot be opened.
If you see this warning, it means that the app was not notarized, and Apple could not scan the app for known malicious software.
You may want to look for an updated version of the app in the App Store or look for an alternative app.
If macOS detects a malicious app
If macOS detects that an app has malicious content, it will notify you when you try to open it and ask you to move it to the Trash.
How to open an app that hasn’t been notarized or is from an unidentified developer
Running software that hasn’t been signed and notarized may expose your computer and personal information to malware that can harm your Mac or compromise your privacy. If you’re certain that an app you want to install is from a trustworthy source and hasn’t been tampered with, you can temporarily override your Mac security settings to open it.
In macOS Catalina and macOS Mojave, when an app fails to install because it hasn’t been notarized or is from an unidentified developer, it will appear in System Preferences > Security & Privacy, under the General tab. Click Open Anyway to confirm your intent to open or install the app.
The warning prompt reappears, and you can click Open.*
The app is now saved as an exception to your security settings, and you can open it in the future by double-clicking it, just as you can any authorized app.
*If you're prompted to open Finder: control-click the app in Finder, choose Open from the menu, and then click Open in the dialog that appears. Enter your admin name and password to open the app.
About Apple security updates
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.
Apple security documents reference vulnerabilities by CVE-ID when possible.
For more information about security, see the Apple Product Security page.
macOS Catalina 10.15
Released October 7, 2019
AMD
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2019-8748: Lilang Wu and Moony Li of TrendMicro Mobile Security Research Team
apache_mod_php
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: Multiple issues in PHP
Description: Multiple issues were addressed by updating to PHP version 7.3.8.
CVE-2019-11041
CVE-2019-11042
Audio
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved state management.
CVE-2019-8706: Yu Zhou of Ant-financial Light-Year Security Lab
Entry added October 29, 2019
Audio
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: Processing a maliciously crafted audio file may disclose restricted memory
Description: An out-of-bounds read was addressed with improved input validation.
CVE-2019-8850: Anonymous working with Trend Micro Zero Day Initiative
Entry added December 4, 2019
Books
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: Parsing a maliciously crafted iBooks file may lead to a persistent denial-of-service
Description: A resource exhaustion issue was addressed with improved input validation.
CVE-2019-8774: Gertjan Franken imec-DistriNet of KU Leuven
Entry added October 29, 2019
CFNetwork
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: Processing maliciously crafted web content may lead to a cross site scripting attack
Description: This issue was addressed with improved checks.
CVE-2019-8753: Łukasz Pilorz of Standard Chartered GBS Poland
Entry added October 29, 2019
CoreAudio
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: Processing a maliciously crafted movie may result in the disclosure of process memory
Description: A memory corruption issue was addressed with improved validation.
CVE-2019-8705: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative
CoreAudio
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: Playing a malicious audio file may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
CVE-2019-8592: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative
Entry added November 6, 2019
CoreCrypto
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: Processing a large input may lead to a denial of service
Description: A denial of service issue was addressed with improved input validation.
CVE-2019-8741: Nicky Mouha of NIST
Entry added October 29, 2019
CoreMedia
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved state management.
CVE-2019-8825: Found by GWP-ASan in Google Chrome
Entry added October 29, 2019
Crash Reporter
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: The 'Share Mac Analytics' setting may not be disabled when a user deselects the switch to share analytics
Description: A race condition existed when reading and writing user preferences. This was addressed with improved state handling.
CVE-2019-8757: William Cerniuk of Core Development, LLC
CUPS
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: An attacker in a privileged network position may be able to leak sensitive user information
Description: An input validation issue was addressed with improved input validation.
CVE-2019-8736: Pawel Gocyla of ING Tech Poland (ingtechpoland.com)
Entry added October 29, 2019
CUPS
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: Processing a maliciously crafted string may lead to heap corruption
Description: A memory consumption issue was addressed with improved memory handling.
CVE-2019-8767: Stephen Zeisberg
Entry added October 29, 2019
CUPS
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: An attacker in a privileged position may be able to perform a denial of service attack
Description: A denial of service issue was addressed with improved validation.
CVE-2019-8737: Pawel Gocyla of ING Tech Poland (ingtechpoland.com)
Entry added October 29, 2019
dyld
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2019-8776: Jann Horn of Google Project Zero
Entry added February 3, 2020
File Quarantine
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: A malicious application may be able to elevate privileges
Description: This issue was addressed by removing the vulnerable code.
CVE-2019-8509: CodeColorist of Ant-Financial LightYear Labs
Entry added October 29, 2019
Foundation
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution
Description: An out-of-bounds read was addressed with improved input validation.
CVE-2019-8746: Natalie Silvanovich and Samuel Groß of Google Project Zero
Entry added October 29, 2019
Graphics
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: Processing a malicious shader may result in unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved input validation.
CVE-2018-12152: Piotr Bania of Cisco Talos
CVE-2018-12153: Piotr Bania of Cisco Talos
CVE-2018-12154: Piotr Bania of Cisco Talos
Entry added October 29, 2019
IOGraphics
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: A local user may be able to cause unexpected system termination or read kernel memory
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2019-8759: another of 360 Nirvan Team
Entry added October 29, 2019
Intel Graphics Driver
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2019-8758: Lilang Wu and Moony Li of Trend Micro
IOGraphics
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: A malicious application may be able to determine kernel memory layout
Description: A logic issue was addressed with improved restrictions.
CVE-2019-8755: Lilang Wu and Moony Li of Trend Micro
Kernel
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: A local app may be able to read a persistent account identifier
Description: A validation issue was addressed with improved logic.
CVE-2019-8809: Apple
Entry added October 29, 2019
Kernel
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: A malicious application may be able to determine kernel memory layout
Description: A memory corruption issue existed in the handling of IPv6 packets. This issue was addressed with improved memory management.
CVE-2019-8744: Zhuo Liang of Qihoo 360 Vulcan Team
Entry added October 29, 2019
Kernel
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2019-8717: Jann Horn of Google Project Zero
Kernel
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed with improved state management.
CVE-2019-8709: derrek (@derrekr6) derrek (@derrekr6)
CVE-2019-8781: Linus Henze (pinauten.de)
Entry updated October 29, 2019
libxml2
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: Multiple issues in libxml2
Description: Multiple memory corruption issues were addressed with improved input validation.
CVE-2019-8749: found by OSS-Fuzz
CVE-2019-8756: found by OSS-Fuzz
Entry added October 29, 2019
libxslt
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: Multiple issues in libxslt
Description: Multiple memory corruption issues were addressed with improved input validation.
CVE-2019-8750: found by OSS-Fuzz
Entry added October 29, 2019
mDNSResponder
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: An attacker in physical proximity may be able to passively observe device names in AWDL communications
Description: This issue was resolved by replacing device names with a random identifier.
CVE-2019-8799: David Kreitschmann and Milan Stute of Secure Mobile Networking Lab at Technische Universität Darmstadt
Entry added October 29, 2019
Menus
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved state management.
CVE-2019-8826: Found by GWP-ASan in Google Chrome
Entry added October 29, 2019
Notes
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: A local user may be able to view a user’s locked notes
Description: The contents of locked notes sometimes appeared in search results. This issue was addressed with improved data cleanup.
CVE-2019-8730: Jamie Blumberg (@jamie_blumberg) of Virginia Polytechnic Institute and State University
PDFKit
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: An attacker may be able to exfiltrate the contents of an encrypted PDF
Description: An issue existed in the handling of links in encrypted PDFs. This issue was addressed by adding a confirmation prompt.
CVE-2019-8772: Jens Müller of Ruhr University Bochum, Fabian Ising of FH Münster University of Applied Sciences, Vladislav Mladenov of Ruhr University Bochum, Christian Mainka of Ruhr University Bochum, Sebastian Schinzel of FH Münster University of Applied Sciences, and Jörg Schwenk of Ruhr University Bochum
PluginKit
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: A local user may be able to check for the existence of arbitrary files
Description: A logic issue was addressed with improved restrictions.
CVE-2019-8708: an anonymous researcher
Entry added October 29, 2019
PluginKit
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2019-8715: an anonymous researcher
Entry added October 29, 2019
Sandbox
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: A malicious application may be able to access restricted files
Description: An access issue was addressed with additional sandbox restrictions.
CVE-2019-8855: Apple
Entry added December 18, 2019
SharedFileList
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: A malicious application may be able to access recent documents
Description: The issue was addressed with improved permissions logic.
CVE-2019-8770: Stanislav Zinukhov of Parallels International GmbH
sips
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2019-8701: Simon Huang(@HuangShaomang), Rong Fan(@fanrong1992) and pjf of IceSword Lab of Qihoo 360
UIFoundation
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: Parsing a maliciously crafted text file may lead to disclosure of user information
Description: This issue was addressed with improved checks.
CVE-2019-8761: Renee Trisberg of SpectX
Entry added October 29, 2019
UIFoundation
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: Processing a maliciously crafted text file may lead to arbitrary code execution
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2019-8745: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative
UIFoundation
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2019-8831: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative
Entry added November 18, 2019
WebKit
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: Visiting a maliciously crafted website may reveal browsing history
Description: An issue existed in the drawing of web page elements. The issue was addressed with improved logic.
CVE-2019-8769: Piérre Reimertz (@reimertz)
WebKit
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: A user may be unable to delete browsing history items
Description: 'Clear History and Website Data' did not clear the history. The issue was addressed with improved data deletion.
CVE-2019-8768: Hugo S. Diaz (coldpointblue)
Wi-Fi
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013 and later)
Impact: A device may be passively tracked by its WiFi MAC address
Description: A user privacy issue was addressed by removing the broadcast MAC address.
CVE-2019-8854: FuriousMacTeam of the United States Naval Academy and the Mitre Cooperation, Ta-Lun Yen of UCCU Hacker
Entry added December 4, 2019, updated December 18, 2019
Additional recognition
AppleRTC
We would like to acknowledge Vitaly Cheptsov for their assistance.
Entry added October 29, 2019
Audio
We would like to acknowledge riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative for their assistance.
Entry added October 29, 2019
boringssl
We would like to acknowledge Nimrod Aviram of Tel Aviv University, Robert Merget of Ruhr University Bochum, Juraj Somorovsky of Ruhr University Bochum, Thijs Alkemade (@xnyhps) of Computest for their assistance.
Entry added October 8, 2019, updated October 29, 2019
curl
We would like to acknowledge Joseph Barisa of The School District of Philadelphia for their assistance.
Entry added February 3, 2020, updated February 11, 2020
Finder
We would like to acknowledge Csaba Fitzl (@theevilbit) for their assistance.
Gatekeeper
We would like to acknowledge Csaba Fitzl (@theevilbit) for their assistance.
Identity Service
We would like to acknowledge Yiğit Can YILMAZ (@yilmazcanyigit) for their assistance.
Entry added October 29, 2019
Kernel
We would like to acknowledge Brandon Azad of Google Project Zero for their assistance.
Entry added October 29, 2019
Local Authentication
We would like to acknowledge Ryan Lopopolo for their assistance.
Entry added February 3, 2020
mDNSResponder
We would like to acknowledge Gregor Lang of e.solutions GmbH for their assistance.
Macos Avast
Entry added October 29, 2019
Avast Security For Mac With Mac Catalina 2016
python
We would like to acknowledge an anonymous researcher for their assistance.
Entry added October 29, 2019
Safari Data Importing
We would like to acknowledge Kent Zoya for their assistance.
Security
We would like to acknowledge Pepijn Dutour Geerling (pepijn.io), an anonymous researcher for their assistance.
Entry added November 18, 2019
Simple certificate enrollment protocol (SCEP)
We would like to acknowledge an anonymous researcher for their assistance.
Siri
We would like to acknowledge Yuval Ron, Amichai Shulman and Eli Biham of Technion of Israel Institute of Technology for their assistance.
Entry added December 4, 2019, updated December 18, 2019
Telephony
We would like to acknowledge Phil Stokes from SentinelOne for their assistance.
VPN
We would like to acknowledge Royce Gawron of Second Son Consulting, Inc. for their assistance.
Avast Security For Mac With Mac Catalina 2016
Entry added October 29, 2019