Update To Catalina

/ Comments off



On Catalina Island stay in one of our Avalon hotels and you'll be close to it all. The Pavilion Hotel is just steps from the beach & the Hotel Atwater is 1 block to the beach. WELCOME BACK - Travel Update - 3.21.21.

About Apple security updates

For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.

Apple security documents reference vulnerabilities by CVE-ID when possible.

For more information about security, see the Apple Product Security page.

Catalina is an early launch partner of Switchboard, a module within The Tapad Graph that will connect emerging cookieless identifiers to traditional IDs, creating a more holistic view of the consumer and driving value exchange within the advertising ecosystem. This document describes the security content of macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available.

macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave

Released February 1, 2021

Analytics

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: A remote attacker may be able to cause a denial of service

Description: This issue was addressed with improved checks.

CVE-2021-1761: Cees Elzinga

APFS

Available for: macOS Big Sur 11.0.1

Impact: A local user may be able to read arbitrary files

Description: The issue was addressed with improved permissions logic.

CVE-2021-1797: Thomas Tempelmann

CFNetwork Cache

Available for: macOS Catalina 10.15.7 and macOS Mojave 10.14.6

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: An integer overflow was addressed with improved input validation.

CVE-2020-27945: Zhuo Liang of Qihoo 360 Vulcan Team

CoreAnimation

Available for: macOS Big Sur 11.0.1

Impact: A malicious application could execute arbitrary code leading to compromise of user information

Description: A memory corruption issue was addressed with improved state management.

CVE-2021-1760: @S0rryMybad of 360 Vulcan Team

CoreAudio

Available for: macOS Big Sur 11.0.1

Impact: Processing maliciously crafted web content may lead to code execution

Description: An out-of-bounds write was addressed with improved input validation.

CVE-2021-1747: JunDong Xie of Ant Security Light-Year Lab

CoreGraphics

Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.7, macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted font file may lead to arbitrary code execution

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2021-1776: Ivan Fratric of Google Project Zero

Entry updated March 16, 2021

CoreMedia

Available for: macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2021-1759: Hou JingYi (@hjy79425575) of Qihoo 360 CERT

CoreText

Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.7, macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted text file may lead to arbitrary code execution

Description: A stack overflow was addressed with improved input validation.

CVE-2021-1772: Mickey Jin (@patch1t) of Trend Micro working with Trend Micro’s Zero Day Initiative

Entry updated March 16, 2021

CoreText

Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.7, macOS Big Sur 11.0.1

Impact: A remote attacker may be able to cause arbitrary code execution

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2021-1792: Mickey Jin & Junzhi Lu of Trend Micro working with Trend Micro’s Zero Day Initiative

Entry updated March 16, 2021

Crash Reporter

Available for: macOS Catalina 10.15.7

Impact: A remote attacker may be able to cause a denial of service

Description: This issue was addressed with improved checks.

CVE-2021-1761: Cees Elzinga

Crash Reporter

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Update To Catalina From High Sierra

Impact: A local attacker may be able to elevate their privileges

Description: Multiple issues were addressed with improved logic.

CVE-2021-1787: James Hutchins

Crash Reporter

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: A local user may be able to create or modify system files

Description: A logic issue was addressed with improved state management.

CVE-2021-1786: Csaba Fitzl (@theevilbit) of Offensive Security

Directory Utility

Available for: macOS Catalina 10.15.7

Impact: A malicious application may be able to access private information

Description: A logic issue was addressed with improved state management.

CVE-2020-27937: Wojciech Reguła (@_r3ggi) of SecuRing

Endpoint Security

Available for: macOS Catalina 10.15.7

Impact: A local attacker may be able to elevate their privileges

Description: A logic issue was addressed with improved state management.

CVE-2021-1802: Zhongcheng Li (@CK01) of WPS Security Response Center

FairPlay

Available for: macOS Big Sur 11.0.1

Impact: A malicious application may be able to disclose kernel memory

Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation.

Update to catalina from yosemite

CVE-2021-1791: Junzhi Lu (@pwn0rz), Qi Sun & Mickey Jin of Trend Micro working with Trend Micro’s Zero Day Initiative

FontParser

Available for: macOS Catalina 10.15.7

Impact: Processing a maliciously crafted font may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2021-1790: Peter Nguyen Vu Hoang of STAR Labs

FontParser

Available for: macOS Mojave 10.14.6

Impact: Processing a maliciously crafted font may lead to arbitrary code execution

Description: This issue was addressed by removing the vulnerable code.

CVE-2021-1775: Mickey Jin and Qi Sun of Trend Micro working with Trend Micro’s Zero Day Initiative

Entry updated March 16, 2021

FontParser

Available for: macOS Mojave 10.14.6

Impact: A remote attacker may be able to leak memory

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2020-29608: Xingwei Lin of Ant Security Light-Year Lab

FontParser

Available for: macOS Big Sur 11.0.1 and macOS Catalina 10.15.7

Impact: A remote attacker may be able to cause arbitrary code execution

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2021-1758: Peter Nguyen of STAR Labs

ImageIO

Available for: macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An access issue was addressed with improved memory management.

CVE-2021-1783: Xingwei Lin of Ant Security Light-Year Lab

ImageIO

Available for: macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2021-1741: Xingwei Lin of Ant Security Light-Year Lab

CVE-2021-1743: Mickey Jin & Junzhi Lu of Trend Micro working with Trend Micro’s Zero Day Initiative, Xingwei Lin of Ant Security Light-Year Lab


ImageIO

Available for: macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted image may lead to a denial of service

Description: A logic issue was addressed with improved state management.

CVE-2021-1773: Xingwei Lin of Ant Security Light-Year Lab

ImageIO

Available for: macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted image may lead to a denial of service

Description: An out-of-bounds read issue existed in the curl. This issue was addressed with improved bounds checking.

CVE-2021-1778: Xingwei Lin of Ant Security Light-Year Lab

ImageIO

Available for: macOS Catalina 10.15.7, macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2021-1736: Xingwei Lin of Ant Security Light-Year Lab

CVE-2021-1785: Xingwei Lin of Ant Security Light-Year Lab

Entry updated March 16, 2021

ImageIO

Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.7, macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted image may lead to a denial of service

Description: This issue was addressed with improved checks.

CVE-2021-1766: Danny Rosseau of Carve Systems

Entry updated March 16, 2021

ImageIO

Available for: macOS Catalina 10.15.7, macOS Big Sur 11.0.1

Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution

Description: A logic issue was addressed with improved state management.

CVE-2021-1818: Xingwei Lin of Ant-Financial Light-Year Security Lab

Entry updated March 16, 2021

ImageIO

Available for: macOS Catalina 10.15.7, macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: This issue was addressed with improved checks.

CVE-2021-1742: Xingwei Lin of Ant Security Light-Year Lab

CVE-2021-1746: Jeonghoon Shin(@singi21a) of THEORI, Mickey Jin & Qi Sun of Trend Micro working with Trend Micro’s Zero Day Initiative, Xingwei Lin of Ant Security Light-Year Lab

CVE-2021-1754: Xingwei Lin of Ant Security Light-Year Lab

CVE-2021-1774: Xingwei Lin of Ant Security Light-Year Lab

CVE-2021-1777: Xingwei Lin of Ant Security Light-Year Lab

CVE-2021-1793: Xingwei Lin of Ant Security Light-Year Lab

Entry updated March 16, 2021

ImageIO

Available for: macOS Big Sur 11.0.1 and macOS Catalina 10.15.7

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds write was addressed with improved input validation.

CVE-2021-1737: Xingwei Lin of Ant Security Light-Year Lab

CVE-2021-1738: Lei Sun

CVE-2021-1744: Xingwei Lin of Ant Security Light-Year Lab

IOKit

Available for: macOS Big Sur 11.0.1

Impact: An application may be able to execute arbitrary code with system privileges

Description: A logic error in kext loading was addressed with improved state handling.

CVE-2021-1779: Csaba Fitzl (@theevilbit) of Offensive Security

IOSkywalkFamily

Available for: macOS Big Sur 11.0.1

Impact: A local attacker may be able to elevate their privileges

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2021-1757: Pan ZhenPeng (@Peterpan0927) of Alibaba Security, Proteas

Kernel

Available for: macOS Catalina 10.15.7 and macOS Mojave 10.14.6

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A logic issue existed resulting in memory corruption. This was addressed with improved state management.

CVE-2020-27904: Zuozhi Fan (@pattern_F_) of Ant Group Tianqiong Security Lab

Kernel

Available for: macOS Big Sur 11.0.1

Impact: A remote attacker may be able to cause a denial of service

Description: A use after free issue was addressed with improved memory management.

CVE-2021-1764: @m00nbsd

Kernel

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited.

Description: A race condition was addressed with improved locking.

CVE-2021-1782: an anonymous researcher

Kernel

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: Multiple issues were addressed with improved logic.

CVE-2021-1750: @0xalsr

Login Window

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: An attacker in a privileged network position may be able to bypass authentication policy

Description: An authentication issue was addressed with improved state management.

CVE-2020-29633: Jewel Lambert of Original Spin, LLC.

Messages

Available for: macOS Big Sur 11.0.1

Impact: A malicious application may be able to leak sensitive user information

Description: A privacy issue existed in the handling of Contact cards. This was addressed with improved state management.

CVE-2021-1781: Csaba Fitzl (@theevilbit) of Offensive Security

Entry added March 16, 2021

Messages

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: A user that is removed from an iMessage group could rejoin the group

Description: This issue was addressed with improved checks.

CVE-2021-1771: Shreyas Ranganatha (@strawsnoceans)

Model I/O

Available for: macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution

Description: An out-of-bounds write was addressed with improved input validation.

CVE-2021-1762: Mickey Jin of Trend Micro working with Trend Micro’s Zero Day Initiative

Entry updated March 16, 2021

Model I/O

Available for: macOS Catalina 10.15.7

Impact: Processing a maliciously crafted file may lead to heap corruption

Description: This issue was addressed with improved checks.

CVE-2020-29614: ZhiWei Sun (@5n1p3r0010) of Topsec Alpha Lab

Model I/O

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution

Description: A buffer overflow was addressed with improved bounds checking.

CVE-2021-1763: Mickey Jin of Trend Micro working with Trend Micro’s Zero Day Initiative

Model I/O

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: Processing a maliciously crafted image may lead to heap corruption

Description: This issue was addressed with improved checks.

CVE-2021-1767: Mickey Jin & Junzhi Lu of Trend Micro working with Trend Micro’s Zero Day Initiative

Model I/O

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2021-1745: Mickey Jin & Junzhi Lu of Trend Micro working with Trend Micro’s Zero Day Initiative

Model I/O

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2021-1753: Mickey Jin of Trend Micro working with Trend Micro’s Zero Day Initiative

Model I/O

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2021-1768: Mickey Jin & Junzhi Lu of Trend Micro working with Trend Micro’s Zero Day Initiative

NetFSFramework

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: Mounting a maliciously crafted Samba network share may lead to arbitrary code execution

Description: A logic issue was addressed with improved state management.

CVE-2021-1751: Mikko Kenttälä (@Turmio_) of SensorFu

OpenLDAP

Starting September 12, T-Mobile One customers with two or more lines will be able to get a free Netflix subscription. Here's how to do it. MacBook (2015 and later) iMac (2015 and later) iMac Pro; Mac Pro (Late 2013) How To Download Windows 10 For Free on a Mac. If you’ve got all this, then you’re ready to go. Here’s how to install Windows 10 for free on your Mac. Go to the Windows 10 ISO Disc Image download site where you can download a 64-bit version of Windows 10 Home. Download netflix films onto macbook. A Berlin-based company just launched Peppr, an app that mimics the dating website model to connect prostitutes with prospective clients. Peppr calls itself the “first mobile web-app for booking. It's easy to download a folder from Google Drive on to your PC or Mac computer, and the process is the same regardless of your device. This story is a part of Business Insider's Guide to Google.

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Update To Catalina From High Sierra

Impact: A remote attacker may be able to cause a denial of service

Update To Catalina From Mojave

Description: This issue was addressed with improved checks.

CVE-2020-25709

Power Management

Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.7

Impact: A malicious application may be able to elevate privileges

Description: A logic issue was addressed with improved state management.

CVE-2020-27938: Tim Michaud (@TimGMichaud) of Leviathan

Screen Sharing

Available for: macOS Big Sur 11.0.1

Impact: Multiple issues in pcre

Description: Multiple issues were addressed by updating to version 8.44.

CVE-2019-20838

CVE-2020-14155

SQLite Mac os x software update.

Available for: macOS Catalina 10.15.7

Impact: Multiple issues in SQLite

Description: Multiple issues were addressed with improved checks.

CVE-2020-15358

Swift

Available for: macOS Big Sur 11.0.1

Impact: A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication

Description: A logic issue was addressed with improved validation.

Catalina

CVE-2021-1769: CodeColorist of Ant-Financial Light-Year Labs

WebKit

Available for: macOS Big Sur 11.0.1

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: A use after free issue was addressed with improved memory management.

CVE-2021-1788: Francisco Alonso (@revskills)

WebKit

Available for: macOS Big Sur 11.0.1

Impact: Maliciously crafted web content may violate iframe sandboxing policy

Description: This issue was addressed with improved iframe sandbox enforcement.

CVE-2021-1765: Eliya Stein of Confiant

CVE-2021-1801: Eliya Stein of Confiant

WebKit

Update To Catalina

Available for: macOS Big Sur 11.0.1

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: A type confusion issue was addressed with improved state handling.

CVE-2021-1789: @S0rryMybad of 360 Vulcan Team

WebKit

Available for: macOS Big Sur 11.0.1

Impact: A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Description: A logic issue was addressed with improved restrictions.

CVE-2021-1871: an anonymous researcher

CVE-2021-1870: an anonymous researcher

WebRTC

Available for: macOS Big Sur 11.0.1

Impact: A malicious website may be able to access restricted ports on arbitrary servers

Description: A port redirection issue was addressed with additional port validation.

CVE-2021-1799: Gregory Vishnepolsky & Ben Seri of Armis Security, and Samy Kamkar

Additional recognition

Kernel

We would like to acknowledge Junzhi Lu (@pwn0rz), Mickey Jin & Jesse Change of Trend Micro for their assistance.

libpthread

We would like to acknowledge CodeColorist of Ant-Financial Light-Year Labs for their assistance.

Login Window

Update To Catalina Not Big Sur

We would like to acknowledge Jose Moises Romero-Villanueva of CrySolve for their assistance.

Mail Drafts

Update To Catalina Macos

We would like to acknowledge Jon Bottarini of HackerOne for their assistance.

Screen Sharing Server

Update To Catalina

We would like to acknowledge @gorelics for their assistance.

WebRTC

We would like to acknowledge Philipp Hancke for their assistance.