Update To Catalina

  1. Update To Catalina Macos
  2. Update To Catalina Os
  3. Update To Catalina On A 2011 Imac
  4. Update To Catalina From Sierra

About Apple security updates

Why downgrade macOS Big Sur. Big Sur is a great update to the Mac operating system (read our Big Sur review), with some useful features and some iOS inspired changes.However, as with Catalina. Download the latest Catalina Installer using the latest Catalina Patcher version. Some third-party applications do not open or crash on launch This is an issue Apple introduced in 10.15.4, and is not an issue with the patch itself.

For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.

Apple security documents reference vulnerabilities by CVE-ID when possible.

For more information about security, see the Apple Product Security page.

macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave

Released February 1, 2021

Analytics

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: A remote attacker may be able to cause a denial of service

Description: This issue was addressed with improved checks.

CVE-2021-1761: Cees Elzinga

APFS

Available for: macOS Big Sur 11.0.1

Impact: A local user may be able to read arbitrary files

Description: The issue was addressed with improved permissions logic.

CVE-2021-1797: Thomas Tempelmann

CFNetwork Cache

Available for: macOS Catalina 10.15.7 and macOS Mojave 10.14.6

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: An integer overflow was addressed with improved input validation.

CVE-2020-27945: Zhuo Liang of Qihoo 360 Vulcan Team

CoreAnimation

Available for: macOS Big Sur 11.0.1

Impact: A malicious application could execute arbitrary code leading to compromise of user information

Description: A memory corruption issue was addressed with improved state management.

CVE-2021-1760: @S0rryMybad of 360 Vulcan Team

CoreAudio

Available for: macOS Big Sur 11.0.1

Impact: Processing maliciously crafted web content may lead to code execution

Description: An out-of-bounds write was addressed with improved input validation.

CVE-2021-1747: JunDong Xie of Ant Security Light-Year Lab

CoreGraphics

Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.7, macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted font file may lead to arbitrary code execution

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2021-1776: Ivan Fratric of Google Project Zero

Entry updated March 16, 2021

CoreMedia

Available for: macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2021-1759: Hou JingYi (@hjy79425575) of Qihoo 360 CERT

CoreText

Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.7, macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted text file may lead to arbitrary code execution

Description: A stack overflow was addressed with improved input validation.

CVE-2021-1772: Mickey Jin (@patch1t) of Trend Micro working with Trend Micro’s Zero Day Initiative

Entry updated March 16, 2021

CoreText

Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.7, macOS Big Sur 11.0.1

Impact: A remote attacker may be able to cause arbitrary code execution

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2021-1792: Mickey Jin & Junzhi Lu of Trend Micro working with Trend Micro’s Zero Day Initiative

Entry updated March 16, 2021

Crash Reporter

Available for: macOS Catalina 10.15.7

Impact: A remote attacker may be able to cause a denial of service

Description: This issue was addressed with improved checks.

CVE-2021-1761: Cees Elzinga

Crash Reporter

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: A local attacker may be able to elevate their privileges

Description: Multiple issues were addressed with improved logic.

CVE-2021-1787: James Hutchins

Clover Configurator 5.4.1.1 (Global Edition) 3.51 MB 75737 downloads Clover Configurator 5.3.0.0 (Global Edition) 3.36 MB 35553 downloads Donate USD. It will appear as EFI on EFI, Install macOS High Sierra (disk.s1) Quit Clover Configurator and copy the entire EFI folder from the Utility and Kext Pack to the EFI partition of your USB, replacing the existing folder if present. The EFI partition on your USB should now contain a single folder named EFI that contains two folders: BOOT and CLOVER. Clover configurator high sierra 10.13.6. Upon launch, Clover Configurator will check to see if there are already available configuration files, and enables you to view their content. In addition, Clover Configurator can check for the latest Clover EFI revision, and helps you download and install the bootloader. VoodooHDA is an open source audio driver for devices compliant with the Intel High Definition Audio specification. It is intended as a replacement for AppleHDA on Mac OS X with support for a wide range of audio controllers and codecs. Here’s detailed steps on how to install macOS High Sierra on a hackintosh using the Clover method with the HFS Method. Apple introduced a new file system called Apple File System (APFS). When High Sierra is installed the drive is automatically converted over to APFS, but there is a way to disable it easily and keep the drive as HPFS by editing an XML file during the install.

Crash Reporter

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: A local user may be able to create or modify system files

Catalina

Description: A logic issue was addressed with improved state management.

CVE-2021-1786: Csaba Fitzl (@theevilbit) of Offensive Security

Directory Utility

Available for: macOS Catalina 10.15.7

Impact: A malicious application may be able to access private information

Description: A logic issue was addressed with improved state management.

CVE-2020-27937: Wojciech Reguła (@_r3ggi) of SecuRing

Endpoint Security

Available for: macOS Catalina 10.15.7

Impact: A local attacker may be able to elevate their privileges

Description: A logic issue was addressed with improved state management.

CVE-2021-1802: Zhongcheng Li (@CK01) of WPS Security Response Center

FairPlay

Available for: macOS Big Sur 11.0.1

Impact: A malicious application may be able to disclose kernel memory

Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation.

CVE-2021-1791: Junzhi Lu (@pwn0rz), Qi Sun & Mickey Jin of Trend Micro working with Trend Micro’s Zero Day Initiative

FontParser

Available for: macOS Catalina 10.15.7

Catalina

Impact: Processing a maliciously crafted font may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2021-1790: Peter Nguyen Vu Hoang of STAR Labs

FontParser

Available for: macOS Mojave 10.14.6

Impact: Processing a maliciously crafted font may lead to arbitrary code execution

Description: This issue was addressed by removing the vulnerable code.

CVE-2021-1775: Mickey Jin and Qi Sun of Trend Micro working with Trend Micro’s Zero Day Initiative

Entry updated March 16, 2021

FontParser

Available for: macOS Mojave 10.14.6

Impact: A remote attacker may be able to leak memory

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2020-29608: Xingwei Lin of Ant Security Light-Year Lab

FontParser

Available for: macOS Big Sur 11.0.1 and macOS Catalina 10.15.7

Impact: A remote attacker may be able to cause arbitrary code execution

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2021-1758: Peter Nguyen of STAR Labs

ImageIO

Available for: macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An access issue was addressed with improved memory management.

CVE-2021-1783: Xingwei Lin of Ant Security Light-Year Lab

ImageIO

Available for: macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2021-1741: Xingwei Lin of Ant Security Light-Year Lab

CVE-2021-1743: Mickey Jin & Junzhi Lu of Trend Micro working with Trend Micro’s Zero Day Initiative, Xingwei Lin of Ant Security Light-Year Lab


ImageIO

Available for: macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted image may lead to a denial of service

Description: A logic issue was addressed with improved state management.

CVE-2021-1773: Xingwei Lin of Ant Security Light-Year Lab

ImageIO

Available for: macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted image may lead to a denial of service

Description: An out-of-bounds read issue existed in the curl. This issue was addressed with improved bounds checking.

CVE-2021-1778: Xingwei Lin of Ant Security Light-Year Lab

ImageIO

Available for: macOS Catalina 10.15.7, macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2021-1736: Xingwei Lin of Ant Security Light-Year Lab

CVE-2021-1785: Xingwei Lin of Ant Security Light-Year Lab

Entry updated March 16, 2021

ImageIO

Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.7, macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted image may lead to a denial of service

Description: This issue was addressed with improved checks.

CVE-2021-1766: Danny Rosseau of Carve Systems

Entry updated March 16, 2021

ImageIO

Available for: macOS Catalina 10.15.7, macOS Big Sur 11.0.1

Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution

Description: A logic issue was addressed with improved state management.

CVE-2021-1818: Xingwei Lin of Ant-Financial Light-Year Security Lab

Entry updated March 16, 2021

ImageIO

Available for: macOS Catalina 10.15.7, macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: This issue was addressed with improved checks.

CVE-2021-1742: Xingwei Lin of Ant Security Light-Year Lab

CVE-2021-1746: Jeonghoon Shin(@singi21a) of THEORI, Mickey Jin & Qi Sun of Trend Micro working with Trend Micro’s Zero Day Initiative, Xingwei Lin of Ant Security Light-Year Lab

CVE-2021-1754: Xingwei Lin of Ant Security Light-Year Lab

CVE-2021-1774: Xingwei Lin of Ant Security Light-Year Lab

CVE-2021-1777: Xingwei Lin of Ant Security Light-Year Lab

CVE-2021-1793: Xingwei Lin of Ant Security Light-Year Lab

Entry updated March 16, 2021

ImageIO

Available for: macOS Big Sur 11.0.1 and macOS Catalina 10.15.7

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds write was addressed with improved input validation.

CVE-2021-1737: Xingwei Lin of Ant Security Light-Year Lab

CVE-2021-1738: Lei Sun

CVE-2021-1744: Xingwei Lin of Ant Security Light-Year Lab

IOKit

Available for: macOS Big Sur 11.0.1

Impact: An application may be able to execute arbitrary code with system privileges

Description: A logic error in kext loading was addressed with improved state handling.

CVE-2021-1779: Csaba Fitzl (@theevilbit) of Offensive Security

IOSkywalkFamily

Available for: macOS Big Sur 11.0.1

Impact: A local attacker may be able to elevate their privileges

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2021-1757: Pan ZhenPeng (@Peterpan0927) of Alibaba Security, Proteas

Kernel

Available for: macOS Catalina 10.15.7 and macOS Mojave 10.14.6

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A logic issue existed resulting in memory corruption. This was addressed with improved state management.

CVE-2020-27904: Zuozhi Fan (@pattern_F_) of Ant Group Tianqiong Security Lab

Kernel

Available for: macOS Big Sur 11.0.1

Impact: A remote attacker may be able to cause a denial of service

Description: A use after free issue was addressed with improved memory management.

CVE-2021-1764: @m00nbsd

Kernel

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited.

Description: A race condition was addressed with improved locking.

CVE-2021-1782: an anonymous researcher

Kernel

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: Multiple issues were addressed with improved logic.

CVE-2021-1750: @0xalsr

Login Window

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: An attacker in a privileged network position may be able to bypass authentication policy

Description: An authentication issue was addressed with improved state management.

CVE-2020-29633: Jewel Lambert of Original Spin, LLC.

Messages

Available for: macOS Big Sur 11.0.1

Impact: A malicious application may be able to leak sensitive user information

Description: A privacy issue existed in the handling of Contact cards. This was addressed with improved state management.

CVE-2021-1781: Csaba Fitzl (@theevilbit) of Offensive Security

Entry added March 16, 2021

Messages

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: A user that is removed from an iMessage group could rejoin the group

Description: This issue was addressed with improved checks.

CVE-2021-1771: Shreyas Ranganatha (@strawsnoceans)

Model I/O

Available for: macOS Big Sur 11.0.1

Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution

Description: An out-of-bounds write was addressed with improved input validation.

Update To Catalina Macos

CVE-2021-1762: Mickey Jin of Trend Micro working with Trend Micro’s Zero Day Initiative

Entry updated March 16, 2021

Model I/O

Available for: macOS Catalina 10.15.7

Impact: Processing a maliciously crafted file may lead to heap corruption

Description: This issue was addressed with improved checks.

CVE-2020-29614: ZhiWei Sun (@5n1p3r0010) of Topsec Alpha Lab

Model I/O

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution

Description: A buffer overflow was addressed with improved bounds checking.

CVE-2021-1763: Mickey Jin of Trend Micro working with Trend Micro’s Zero Day Initiative

Model I/O

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: Processing a maliciously crafted image may lead to heap corruption

Description: This issue was addressed with improved checks.

CVE-2021-1767: Mickey Jin & Junzhi Lu of Trend Micro working with Trend Micro’s Zero Day Initiative

Model I/O

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2021-1745: Mickey Jin & Junzhi Lu of Trend Micro working with Trend Micro’s Zero Day Initiative

Model I/O

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2021-1753: Mickey Jin of Trend Micro working with Trend Micro’s Zero Day Initiative

Model I/O

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2021-1768: Mickey Jin & Junzhi Lu of Trend Micro working with Trend Micro’s Zero Day Initiative

NetFSFramework

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: Mounting a maliciously crafted Samba network share may lead to arbitrary code execution

Description: A logic issue was addressed with improved state management.

CVE-2021-1751: Mikko Kenttälä (@Turmio_) of SensorFu

OpenLDAP

Available for: macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6

Impact: A remote attacker may be able to cause a denial of service

Description: This issue was addressed with improved checks.

CVE-2020-25709

Power Management

Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.7

Impact: A malicious application may be able to elevate privileges

Description: A logic issue was addressed with improved state management.

CVE-2020-27938: Tim Michaud (@TimGMichaud) of Leviathan

Screen Sharing

Available for: macOS Big Sur 11.0.1

Impact: Multiple issues in pcre

Description: Multiple issues were addressed by updating to version 8.44.

CVE-2019-20838

Update To Catalina Os

CVE-2020-14155

SQLite

Available for: macOS Catalina 10.15.7

Impact: Multiple issues in SQLite

Description: Multiple issues were addressed with improved checks.

CVE-2020-15358

Swift

Available for: macOS Big Sur 11.0.1

Impact: A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication

Description: A logic issue was addressed with improved validation.

CVE-2021-1769: CodeColorist of Ant-Financial Light-Year Labs

WebKit

Available for: macOS Big Sur 11.0.1

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: A use after free issue was addressed with improved memory management.

CVE-2021-1788: Francisco Alonso (@revskills)

WebKit

Available for: macOS Big Sur 11.0.1

Impact: Maliciously crafted web content may violate iframe sandboxing policy

Description: This issue was addressed with improved iframe sandbox enforcement.

CVE-2021-1765: Eliya Stein of Confiant

CVE-2021-1801: Eliya Stein of Confiant

WebKit

Available for: macOS Big Sur 11.0.1

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: A type confusion issue was addressed with improved state handling.

CVE-2021-1789: @S0rryMybad of 360 Vulcan Team

WebKit

Available for: macOS Big Sur 11.0.1

Impact: A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Description: A logic issue was addressed with improved restrictions.

CVE-2021-1871: an anonymous researcher

CVE-2021-1870: an anonymous researcher

WebRTC

Available for: macOS Big Sur 11.0.1

Impact: A malicious website may be able to access restricted ports on arbitrary servers

Description: A port redirection issue was addressed with additional port validation.

CVE-2021-1799: Gregory Vishnepolsky & Ben Seri of Armis Security, and Samy Kamkar

Additional recognition

Update To Catalina On A 2011 Imac

Kernel

We would like to acknowledge Junzhi Lu (@pwn0rz), Mickey Jin & Jesse Change of Trend Micro for their assistance.

Update To Catalina From Sierra

libpthread

Update

We would like to acknowledge CodeColorist of Ant-Financial Light-Year Labs for their assistance.

Login Window

We would like to acknowledge Jose Moises Romero-Villanueva of CrySolve for their assistance.

Mail Drafts

We would like to acknowledge Jon Bottarini of HackerOne for their assistance.

Screen Sharing Server

We would like to acknowledge @gorelics for their assistance.

WebRTC

We would like to acknowledge Philipp Hancke for their assistance.