macOS Catalina 10.15.3 Update (19D76) is now Available.
10.15.3 is Catalina’s third update and was released about a month and a half after the 10.15.2 Update. MacOS Catalina 10.15.3 is now available for download as a full installer.app, delta and combo update. Let’s take a look at the Catalina 10.15.3 Update (19D76) to see what’s new.
10.15.3 Patch Notes Summary
- 1 Known Issue
- 1 Undocumented Fix
- 2 Resolved Issues
- EDIT: 23 Security Fixes
Apple’s Public Patch Notes / Release Notes Documentation
developer.apple.com/documentation/macos_release_notes
developer.apple.com/documentation/macos_release_notes/macos_catalina_10_15_3_release_notes
For more detailed information about this update and previous updates, please visit: https://support.apple.com/kb/HT210642
Previous 10.15 Releases + Previous Patch Notes
- 10.15.3 = (19D76) January 28th 2020 = Current Release
- 10.15.2 = (19C57) December 10th 2019
- 10.15.1 = (19B2106) November 13th 2019
- 10.15.1 = (19B88) October 29th 2019
- 10.15.0 = (19A603) October 21st 2019
- 10.15.0 = (19A602) October 15th 2019
- 10.15.0 = (19A583) October 7th 2019
Catalina 10.15.3 Info & Download Links
Delta Update
Link – https://support.apple.com/kb/DL2029
Size = 2.99gb
Product ID = 061-62842
Requirements = 10.15.2
Combo Update
Link –https://support.apple.com/kb/DL2030
Size = 4.59gb
Product ID = 061-62853
Requirements = 10.15.0, 10.15.1 or 10.15.2
HT to Howard Oakley for the download links!!
Full Installer.app
Link – Catalina 10.15.3 Mac App Store
Size = 8.67gb
Product ID = 061-44387
Requirements – 10.15 Catalina Requirements
T2 BridgeOS Update
T2 BridgeOS was updated along with the 10.15.3 update.
BridgeOS Update = 17.16.13050
Catalina 10.15.3 Update (19D76) Overview
The macOS Catalina 10.15.3 update improves the stability, reliability and security of your Mac, and is recommended for all users.
This update:
- Optimizes gamma handling of low gray levels on Pro Display XDR for SDR workflows when using macOS
- Improves multi-stream video editing performance for HEVC and H.264 encoded 4K video on the 16-inch MacBook Pro (2019)
Undocumented Fix – Mail.app Data loss bug is reportedly fixed.
https://mjtsai.com/blog/2019/10/11/mail-data-loss-in-macos-10-15/
Security Content for 10.15.3
https://support.apple.com/en-us/HT210919
- EDIT: removed 4 10.14 and 10.13 only fixes = 23 Security Content Related Fixes
AnnotationKit
Available for: macOS Catalina 10.15.2
Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution
Description: An out-of-bounds read was addressed with improved input validation.
CVE-2020-3877: an anonymous researcher working with Trend Micro’s Zero Day Initiative
apache_mod_php
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: Multiple issues in PHP
Description: Multiple issues were addressed by updating to PHP version 7.3.11.
CVE-2019-11043
Audio
Available for: macOS Catalina 10.15.2
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team
autofs
Available for: macOS Catalina 10.15.2
Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper
Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share.
CVE-2020-3866: Jose Castro Almeida (@HackerOn2Wheels) and René Kroka (@rene_kroka)
Crash Reporter
Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.2
Impact: A malicious application may be able to access restricted files
Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.
CVE-2020-3835: Csaba Fitzl (@theevilbit)
Image Processing
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
CVE-2020-3827: Samuel Groß of Google Project Zero
ImageIO
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: Processing a maliciously crafted image may lead to arbitrary code execution
Description: An out-of-bounds read was addressed with improved input validation.
CVE-2020-3826: Samuel Groß of Google Project Zero
CVE-2020-3870
CVE-2020-3878: Samuel Groß of Google Project Zero
Intel Graphics Driver
Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2020-3845: Zhuo Liang of Qihoo 360 Vulcan Team
IOAcceleratorFamily
Available for: macOS Catalina 10.15.2
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2020-3837: Brandon Azad of Google Project Zero
IPSec
Available for: macOS Catalina 10.15.2
Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution
Description: An off by one issue existed in the handling of racoon configuration files. This issue was addressed through improved bounds checking.
CVE-2020-3840: @littlelailo
Kernel
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
CVE-2020-3875: Brandon Azad of Google Project Zero
Kernel
Available for: macOS Catalina 10.15.2
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed with improved memory handling.
CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite
Kernel
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: A malicious application may be able to execute arbitrary code with system privileges
Description: A type confusion issue was addressed with improved memory handling.
CVE-2020-3853: Brandon Azad of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: A malicious application may be able to determine kernel memory layout
Description: An access issue was addressed with improved memory management.
CVE-2020-3836: Brandon Azad of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2020-3842: Ned Williamson working with Google Project Zero
CVE-2020-3871: Corellium
libxpc
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: Processing a maliciously crafted string may lead to heap corruption
Description: A memory corruption issue was addressed with improved input validation.
CVE-2020-3856: Ian Beer of Google Project Zero
libxpc
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: An application may be able to gain elevated privileges
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2020-3829: Ian Beer of Google Project Zero
PackageKit
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: A malicious application may be able to overwrite arbitrary files
Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.
CVE-2020-3830: Csaba Fitzl (@theevilbit)
Security
Available for: macOS Catalina 10.15.2
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg
sudo
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: Certain configurations may allow a local attacker to execute arbitrary code
Description: A buffer overflow issue was addressed with improved memory handling.
CVE-2019-18634: Apple
Wi-Fi
Available for: macOS Catalina 10.15.2
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro’s Zero Day Initiative
Wi-Fi
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory
Description: A memory corruption issue was addressed with improved input validation.
CVE-2020-3843: Ian Beer of Google Project Zero
wifivelocityd
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2
Impact: An application may be able to execute arbitrary code with system privileges
Description: The issue was addressed with improved permissions logic.
CVE-2020-3838: Dayton Pidhirney (@_watbulb)
So, is it okay to update to Catalina now–or should Mojave users wait a little longer? Im asking for a friend as I’m still on an older macbook pro and running High Sierra. BTW: I appreciate all the info from your blog as today we really need this support.
Bill,
How old is the MacBook Pro? Even if it’s a 2012 version you should be ok. Usually by the third point release things are starting to fall into place. The one thing to double check is your apps as 32 bit apps will NOT RUN on 10.15! You can also run a time machine backup just in case. Other than that though again you should be good. If something goes wrong you can always downgrade and use your backup. Let me know how it goes.
Thank you for your comments!
Thanks for the feedback. I don’t plan to update my old MacBook as it’s a late 2011 model and I had to jump through all sorts of hoops to keep it working due to the graphics cards and issues caused by the H. Sierra updates. But my neighbour asked me as she does not want to upgrade her OS if Catalina’s not debugged.
My 2012 MacBook Pro is fine using Catalina but there have been a few glitches here and there, some which were fixed when I did the update. My 2011 is still on High Sierra and working fine since I edited the code to bypass the troublesome GPU that these are well know for. As long as I don’t update it again it should be fine.
Did I understand correctly that the latest update to Catalina will prevent us from deciding to update if we install it? If future updates then become automatic we won’t be able to avoid bugs that might appear in an update–that’s not desirable.