macOS Catalina 10.15.3 Update (19D76) is now Available.
10.15.3 is Catalina’s third update and was released about a month and a half after the 10.15.2 Update. MacOS Catalina 10.15.3 is now available for download as a full installer.app, delta and combo update. Let’s take a look at the Catalina 10.15.3 Update (19D76) to see what’s new.
10.15.3 Patch Notes Summary
- 1 Known Issue
- 1 Undocumented Fix
- 2 Resolved Issues
- EDIT: 23 Security Fixes
Apple’s Public Patch Notes / Release Notes Documentation
developer.apple.com/documentation/macos_release_notes
developer.apple.com/documentation/macos_release_notes/macos_catalina_10_15_3_release_notes
For more detailed information about this update and previous updates, please visit: https://support.apple.com/kb/HT210642
Previous 10.15 Releases + Previous Patch Notes
- 10.15.3 = (19D76) January 28th 2020 = Current Release
- 10.15.2 = (19C57) December 10th 2019
- 10.15.1 = (19B2106) November 13th 2019
- 10.15.1 = (19B88) October 29th 2019
- 10.15.0 = (19A603) October 21st 2019
- 10.15.0 = (19A602) October 15th 2019
- 10.15.0 = (19A583) October 7th 2019
Catalina 10.15.3 Info & Download Links
[the_ad id=”4707″]
Delta Update
Link– https://support.apple.com/kb/DL2029
Size = 2.99gb
Product ID = 061-62842
Requirements = 10.15.2
Combo Update
Link –https://support.apple.com/kb/DL2030
Size = 4.59gb
Product ID = 061-62853
Requirements = 10.15.0, 10.15.1 or 10.15.2
HT to Howard Oakley for the download links!!
Full Installer.app
Link – Catalina 10.15.3 Mac App Store
Size = 8.67gb
Product ID = 061-44387
Requirements – 10.15 Catalina Requirements
T2 BridgeOS Update
[the_ad id=”3754″]
T2 BridgeOS was updated along with the 10.15.3 update.
BridgeOS Update = 17.16.13050
Catalina 10.15.3 Update (19D76) Overview
The macOS Catalina 10.15.3 update improves the stability, reliability and security of your Mac, and is recommended for all users.
This update:
- Optimizes gamma handling of low gray levels on Pro Display XDR for SDR workflows when using macOS
- Improves multi-stream video editing performance for HEVC and H.264 encoded 4K video on the 16-inch MacBook Pro (2019)
Undocumented Fix – Mail.app Data loss bug is reportedly fixed.
Security Content for 10.15.3
- EDIT: removed 4 10.14 and 10.13 only fixes = 23 Security Content Related Fixes
ANNOTATIONKIT
Available for: macOS Catalina 10.15.2
Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution
Description: An out-of-bounds read was addressed with improved input validation.
CVE-2020-3877: an anonymous researcher working with Trend Micro’s Zero Day Initiative
APACHE_MOD_PHP
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: Multiple issues in PHP
Description: Multiple issues were addressed by updating to PHP version 7.3.11.
CVE-2019-11043
AUDIO
Available for: macOS Catalina 10.15.2
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team
AUTOFS
Available for: macOS Catalina 10.15.2
Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper
Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share.
CVE-2020-3866: Jose Castro Almeida (@HackerOn2Wheels) and René Kroka (@rene_kroka)
CRASH REPORTER
Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.2
Impact: A malicious application may be able to access restricted files
Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.
CVE-2020-3835: Csaba Fitzl (@theevilbit)
IMAGE PROCESSING
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
CVE-2020-3827: Samuel Groß of Google Project Zero
IMAGEIO
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: Processing a maliciously crafted image may lead to arbitrary code execution
Description: An out-of-bounds read was addressed with improved input validation.
CVE-2020-3826: Samuel Groß of Google Project Zero
CVE-2020-3870
CVE-2020-3878: Samuel Groß of Google Project Zero
INTEL GRAPHICS DRIVER
Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2020-3845: Zhuo Liang of Qihoo 360 Vulcan Team
IOACCELERATORFAMILY
Available for: macOS Catalina 10.15.2
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2020-3837: Brandon Azad of Google Project Zero
IPSEC
Available for: macOS Catalina 10.15.2
Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution
Description: An off by one issue existed in the handling of racoon configuration files. This issue was addressed through improved bounds checking.
CVE-2020-3840: @littlelailo
KERNEL
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
CVE-2020-3875: Brandon Azad of Google Project Zero
KERNEL
Available for: macOS Catalina 10.15.2
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed with improved memory handling.
CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite
KERNEL
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: A malicious application may be able to execute arbitrary code with system privileges
Description: A type confusion issue was addressed with improved memory handling.
CVE-2020-3853: Brandon Azad of Google Project Zero
KERNEL
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: A malicious application may be able to determine kernel memory layout
Description: An access issue was addressed with improved memory management.
CVE-2020-3836: Brandon Azad of Google Project Zero
KERNEL
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2020-3842: Ned Williamson working with Google Project Zero
CVE-2020-3871: Corellium
LIBXPC
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: Processing a maliciously crafted string may lead to heap corruption
Description: A memory corruption issue was addressed with improved input validation.
CVE-2020-3856: Ian Beer of Google Project Zero
LIBXPC
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: An application may be able to gain elevated privileges
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2020-3829: Ian Beer of Google Project Zero
PACKAGEKIT
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: A malicious application may be able to overwrite arbitrary files
Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.
CVE-2020-3830: Csaba Fitzl (@theevilbit)
SECURITY
Available for: macOS Catalina 10.15.2
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg
SUDO
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: Certain configurations may allow a local attacker to execute arbitrary code
Description: A buffer overflow issue was addressed with improved memory handling.
CVE-2019-18634: Apple
WI-FI
Available for: macOS Catalina 10.15.2
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro’s Zero Day Initiative
WI-FI
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory
Description: A memory corruption issue was addressed with improved input validation.
CVE-2020-3843: Ian Beer of Google Project Zero
WIFIVELOCITYD
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: An application may be able to execute arbitrary code with system privileges
Description: The issue was addressed with improved permissions logic.
