About Apple security updates
For our customers' protection, Apple doesn't disclose, discuss or confirm security issues until an investigation has taken place and patches or releases are available. Recent releases are listed on the Apple security updates page.
Apple security documents reference vulnerabilities by CVE-ID when possible.
For more information about security, see the Apple Product Security page.
iCloud for Windows 7.14
Released 7 October 2019
CoreCrypto
Available for: Windows 7 and later
Impact: Processing a large input may lead to a denial of service
Description: A denial-of-service issue was addressed with improved input validation.
CVE-2019-8741: Nicky Mouha of NIST
Entry added 29 October 2019
CoreMedia
Available for: Windows 7 and later
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved state management.
CVE-2019-8825: Found by GWP-ASan in Google Chrome
Entry added 29 October 2019
Foundation
Available for: Windows 7 and later
Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution
Description: An out-of-bounds read was addressed with improved input validation.
CVE-2019-8746: natashenka and Samuel Groß of Google Project Zero
Entry added 29 October 2019
libxml2
Available for: Windows 7 and later
Impact: Multiple issues in libxml2
Description: Multiple memory corruption issues were addressed with improved input validation.
CVE-2019-8749: found by OSS-Fuzz
CVE-2019-8756: found by OSS-Fuzz
Entry added 29 October 2019
UIFoundation
Available for: Windows 7 and later
Impact: Processing a maliciously crafted text file may lead to arbitrary code execution
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2019-8745: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative
WebKit
Available for: Windows 7 and later
Impact: Processing maliciously crafted web content may lead to universal cross site scripting
Description: A logic issue was addressed with improved state management.
CVE-2019-8625: Sergei Glazunov of Google Project Zero
CVE-2019-8719: Sergei Glazunov of Google Project Zero
CVE-2019-8764: Sergei Glazunov of Google Project Zero
Entry added 29 October 2019
WebKit
Available for: Windows 7 and later
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-8707: an anonymous researcher working with Trend Micro's Zero Day Initiative, cc working with Trend Micro Zero Day Initiative
CVE-2019-8726: Jihui Lu of Tencent KeenLab
CVE-2019-8728: Junho Jang of LINE Security Team and Hanul Choi of ABLY Corporation
CVE-2019-8733: Sergei Glazunov of Google Project Zero
CVE-2019-8734: found by OSS-Fuzz
CVE-2019-8735: G. Geshev working with Trend Micro Zero Day Initiative
CVE-2019-8743: zhunki from Codesafe Team of Legendsec at Qi'anxin Group
CVE-2019-8751: Dongzhuo Zhao working with ADLab of Venustech
CVE-2019-8752: Dongzhuo Zhao working with ADLab of Venustech
CVE-2019-8763: Sergei Glazunov of Google Project Zero
CVE-2019-8765: Samuel Groß of Google Project Zero
CVE-2019-8773: found by OSS-Fuzz
Entry added 29 October 2019
WebKit
Available for: Windows 7 and later
Impact: Processing maliciously crafted web content may lead to universal cross site scripting
Description: A validation issue was addressed with improved logic.
CVE-2019-8762: Sergei Glazunov of Google Project Zero
Entry added 18 November 2019
Additional recognition
Software Update
We would like to acknowledge Michael Gorelik (@smgoreli) of Morphisec (morphisec.com) for their assistance.
WebKit
We would like to acknowledge Yiğit Can YILMAZ (@yilmazcanyigit) and Zhihua Yao of DBAPPSecurity Zion Lab for their assistance.