Apple Imac Update 2020

  

About Apple security updates

  1. Apple Imac Update 2020 Updates
  2. Apple Mac Update 2020
  3. Apple Imac Update 2020 Updates

For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.

Apple security documents reference vulnerabilities by CVE-ID when possible.

For more information about security, see the Apple Product Security page.

macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra

Released January 28, 2020

Apple imac update 2020 problems

The 27-inch iMac was already due for its annual update, having last been reviewed here in April 2019, so the arrival of a new model for 2020 is no great surprise. But, of course, Apple's recent. 2020 iMac Review: Apple's last Intel iMac is its best iMac ever. It may not have Apple silicon inside, but this iMac update is absolutely not a compromise in 2020. The 27-inch iMac launched in August of 2020 may be the last Mac to come with Intel inside. Apple announced at the Worldwide Developer Conference.

AnnotationKit

Available for: macOS Catalina 10.15.2

Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-3877: an anonymous researcher working with Trend Micro's Zero Day Initiative

apache_mod_php

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: Multiple issues in PHP

Description: Multiple issues were addressed by updating to PHP version 7.3.11.

CVE-2019-11043

Audio

Available for: macOS Catalina 10.15.2

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team

autofs

Available for: macOS Catalina 10.15.2

Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper

Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share.

CVE-2020-3866: Jose Castro Almeida (@HackerOn2Wheels) and René Kroka (@rene_kroka)

CoreBluetooth

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.2

Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab

CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab

CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab

Entry updated February 3, 2020

CoreBluetooth

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.2

Impact: A remote attacker may be able to leak memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab

Entry updated February 3, 2020

Crash Reporter

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.2

Impact: A malicious application may be able to access restricted files

Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.

CVE-2020-3835: Csaba Fitzl (@theevilbit)

crontab

Available for: macOS Catalina 10.15.2

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2020-3863: James Hutchins

Entry added September 8, 2020

Found in Apps

Available for: macOS Catalina 10.15.2

Impact: Encrypted data may be inappropriately accessed

Description: An issue existed with Siri Suggestions access to encrypted data. The issue was fixed by limiting access to encrypted data.

2009 apple imac update

CVE-2020-9774: Bob Gendler of the National Institute of Standards and Technology

Entry updated July 28, 2020

Image Processing

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-3827: Samuel Groß of Google Project Zero

ImageIO

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.2

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Apple Imac Update 2020 Updates

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-3826: Samuel Groß of Google Project Zero

CVE-2020-3870

CVE-2020-3878: Samuel Groß of Google Project Zero

CVE-2020-3880: Samuel Groß of Google Project Zero

Entry updated April 4, 2020

Intel Graphics Driver

Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2020-3845: Zhuo Liang of Qihoo 360 Vulcan Team

IOAcceleratorFamily

Available for: macOS Catalina 10.15.2

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2020-3837: Brandon Azad of Google Project Zero

IOThunderboltFamily

Available for: macOS Catalina 10.15.2

Impact: An application may be able to gain elevated privileges

Description: A use after free issue was addressed with improved memory management.

CVE-2020-3851: Xiaolong Bai and Min (Spark) Zheng of Alibaba Inc. and Luyi Xing of Indiana University Bloomington

Entry added April 4, 2020

IPSec

Available for: macOS Catalina 10.15.2

Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution

Description: An off by one issue existed in the handling of racoon configuration files. This issue was addressed through improved bounds checking.

CVE-2020-3840: @littlelailo

Kernel

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2020-3875: Brandon Azad of Google Project Zero

Kernel

Available for: macOS Catalina 10.15.2

Impact: An application may be able to read restricted memory

Description: A memory initialization issue was addressed with improved memory handling.

CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite

Kernel

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: A malicious application may be able to execute arbitrary code with system privileges

Description: A type confusion issue was addressed with improved memory handling.

CVE-2020-3853: Brandon Azad of Google Project Zero

Kernel

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: A malicious application may be able to determine kernel memory layout

Description: An access issue was addressed with improved memory management.

CVE-2020-3836: Brandon Azad of Google Project Zero

Kernel

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2020-3842: Ned Williamson working with Google Project Zero

CVE-2020-3871: Corellium

libxml2

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.2

Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution

Description: A buffer overflow was addressed with improved size validation.

CVE-2020-3846: Ranier Vilela

Entry updated February 3, 2020

libxpc

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: Processing a maliciously crafted string may lead to heap corruption

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-3856: Ian Beer of Google Project Zero

libxpc

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: An application may be able to gain elevated privileges

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2020-3829: Ian Beer of Google Project Zero

PackageKit

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: A malicious application may be able to overwrite arbitrary files

Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.

CVE-2020-3830: Csaba Fitzl (@theevilbit)

Security

Available for: macOS Catalina 10.15.2

Impact: A malicious application may be able to break out of its sandbox

Description: A logic issue was addressed with improved restrictions.

CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg

Entry updated February 3, 2020

sudo

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: Certain configurations may allow a local attacker to execute arbitrary code

Description: A buffer overflow issue was addressed with improved memory handling.

Apple Mac Update 2020

CVE-2019-18634: Apple

System

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6

Impact: A malicious application may be able to overwrite arbitrary files

Description: An access issue was addressed with improved access restrictions.

CVE-2020-3855: Csaba Fitzl (@theevilbit)

Apple Imac Update 2020

Wi-Fi

Available for: macOS Catalina 10.15.2

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro's Zero Day Initiative

Wi-Fi

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.2

Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-3843: Ian Beer of Google Project Zero

Entry updated May 13, 2020

wifivelocityd

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: An application may be able to execute arbitrary code with system privileges

Description: The issue was addressed with improved permissions logic.

CVE-2020-3838: Dayton Pidhirney (@_watbulb)

Additional recognition

Photos Storage

We would like to acknowledge Allison Husain of UC Berkeley for their assistance.

Entry updated March 19, 2020

SharedFileList

We would like to acknowledge Patrick Wardle of Jamf for their assistance.

Entry added April 4, 2020

It was as absolute an answer as you could possibly get. Is Apple merging iOS and macOS? “No,” said Apple software chief Craig Federighi, with an animated accompaniment smashing down on the screen behind him.

And yet… Federighi made that comment just moments before he unveiled a new system, being worked on by Apple over multiple years, that will allow the developers of iOS apps to bring those apps to the Mac more easily. And first up will be Apple itself, which is using this approach to translate the iOS Stocks, Voice Memos, News, and Home apps for macOS Mojave, coming this fall.

While the Mac and iOS might not be merging, major changes are in store for the Mac and the apps it runs. It’s hard to imagine how the Mac of a couple of years hence isn’t populated with apps sourced from iOS. And yet, Apple says, the Mac will remain the Mac.

What does that mean? What will define the Mac in 2020?

What makes a Mac?

Let’s start by considering exactly what Federighi said on stage at WWDC: “We love the Mac, and we love macOS because it’s explicitly created to the unique egonomics of Mac hardware, like the ergonomics of the keyboard and trackpad, the flexibility in displays and storage, and because of the power it exposes, it makes the Mac able to accomplish almost anything.”

In an interview at Wired, he also said: “It’s still macOS, you still have the Terminal, you can still attach four monitors to it, you can still hook up external drives.”

So for Apple, the Mac is defined by physical attributes, hardware flexibility, and exposed computing power. Some of these definitions are clearer than others: It’s unlikely that iOS devices are ever going to offer modular displays and storage devices. I’m not sure I can entirely conceive of iOS never having a tool like the Terminal—if only because it feels inevitable that app development will one day be possible on iOS—but I can accept that the wild-west feel of macOS, where you can arbitrarily install, compile, and write software, is unlikely to ever be reflected on iOS.

2020

It feels like Federighi’s cutting it awfully close on the “unique ergonomics” front, though. Apple itself sells a keyboard for the iPad Pro, and even allows users to move their fingers like they’re using a trackpad when editing text. The iPhone and iMac Pro are about as far as two devices can get from one another, but the MacBook and the iPad Pro are not.

In his interview with Wired, Federighi also pooh-poohed the idea that Apple might make a MacBook with a touchscreen. And yet one of Apple’s greatest arguments against touch on macOS—that Mac software was designed with keyboard and pointing device in mind—is going to very rapidly become obsolete as iOS-sourced apps appear on the Mac in 2019 and 2020.

It’s a tough position for Apple to be in, because of course the company is never going to comment on future products, but it’s still an open question about whether the border between the iPad Pro and the MacBook is immutable or shifting. Until Apple releases an iOS laptop or a MacBook with a touchscreen—or both!—we won’t know if Apple has decided to re-draw the lines.

It’s hard to imagine that Apple would avoid legitimate opportunities to grow the iOS platform just out of fear of treading on the Mac’s sacred ground, though.

Introducing iOS Pro

In a world where relevant iOS apps can be brought to the Mac with ease, what will make the Mac different from iOS will be the flexibility and power that Federighi talked about. One interesting change in this regard seems to be happening on the Mac App Store, where Apple seems to be loosening some of the restrictions that previously forced apps out or barred apps from even considering entry.

In macOS Mojave, Apple has added some new security procedures that allow apps to ask for permission to access information that was previously barred from apps that were sold in the Mac App Store. And perhaps not coincidentally, Monday’s WWDC keynote featured several apps that either never appeared in the Mac App Store or departed the store in frustration over Apple’s policies. This is an encouraging sign that Apple recognizes that beyond the potential avalanche of iOS-sourced Mac apps, the Mac App Store needs to be populated with the sorts of apps that aren’t possible on iOS—and that requires more flexibility on Apple’s part.

I’m sorely tempted to say that the Mac of 2020 will include the best of the iOS App Store, plus the sorts of apps that best take advantage of the power and flexibility of the Mac. You know, like Photoshop and Final Cut Pro and Logic Pro. But the truth is, iOS is becoming so powerful that there’s no reason that Final Cut or Logic couldn’t exist on iOS. (I use Ferrite Recording Studio to edit podcasts on iOS, and it’s amazingly good.)

No, a high-end video professional is probably not going to edit a feature film in 4K on an iPad Pro, but they’re not going to use a low-end MacBook either. If iOS is allowed to continue growing and adapting, it’s hard to imagine Apple erecting artificial barriers on iOS just to protect a few sacred areas on the Mac.

Apple Imac Update 2020 Updates

As a longtime Mac user, I’m excited about getting iOS apps translated over to my Mac—it’s well past time that the Home app appear on macOS. But given the trajectory of iOS, it’s hard not to see this as a temporary approach to making the Mac more useful and viable until the point when iOS itself has the power to accomplish almost anything. That will probably take quite a while, but it feels closer this week than it did last week.