hoakley Macs, Technology

What’s changed in the Mojave 10.14.6 Security Update 2019-002?

The second Security Update for macOS Mojave 10.14.6 (2019-002) was a hefty download considering how few fixes it is reported to include. Of those fixes listed by Apple, only 2 are reported as being fixed in Mojave: one kernel vulnerability, and another in Security. Looking at build numbers of its components reveals that there is more to it than that.

First, it brought EFI firmware updates for many, but by no means all, models. Notable among those are the firmware updates for those with T2 chips, which brings them in line with the latest firmware included in the 10.15.2 update, which was released at the same time. If your Mac has a T2 chip, its firmware version should now be reported as 1037.60.58.0.0 (iBridge: 17.16.12551.0.0,0). If it isn’t, then you may need to apply the update again in the hope that will do the trick.

Unfortunately, even after these firmware updates, some Mac models running 10.13 or 10.14 are still running slightly older firmware versions from the same model upgraded to Catalina 10.15.2. So there is ample scope for confusion. Thanks to great help from Pico, I have updated the lists of firmware versions:

These should also be fully reflected in SilentKnight.

If you are still running Sierra, then Apple has orphaned your Mac with whatever firmware version it has, as Sierra is no longer supported.

In addition to the separate Safari update, the following components in /System/Library have changed with Security Update 2019-002:

  • KeychainSyncAccountNotification.bundle in Accounts/Notification, with an increment in build number
  • HelpViewer.app in CoreServices, with a single increment in build number
  • Keychain Circle Notification.app in CoreServices, with an increment in build number
  • IOGraphicsFamily.kext in Extensions, with a single increment in build number
  • CFNetwork.framework in Frameworks, with a single increment in build number
  • ImageIO.framework in Frameworks, with a single increment in build number
  • Security.framework in Frameworks, with an increment in build number, in its CloudKeychainProxy.bundle, and in authd.xpc
  • AVConference.framework in PrivateFrameworks, with a single increment in build number
  • GameKitServices.framework in PrivateFrameworks, with a single increment in build number
  • LoggingSupport.framework in PrivateFrameworks, with a single increment in build number

Thanks to JoseHill for reporting that tcpdump has also been updated from 4.9.2 to 4.9.3, and libpcap from 1.8.1 to 1.9.1.

Several of these changes may relate to the fixes listed by Apple, although in the case of tcpdump and libpcap these are only listed for Catalina 10.15.2! However, many of these appear unrelated to anything mentioned in release notes for the Security Update. Although Apple has greatly improved its release notes recently, which is much appreciated, they clearly aren’t yet complete descriptions of what has changed in these updates.