Ngg

**Name of the Vulnerable Software and Affected Versions** oqs-provider versions prior to 0.6.1 **Description** The issue arises from the way oqs-provider handles lengths decoded with DECODE UINT32 at the start of serialized hybrid keys and signatures. Unchecked length values are later used for memory reads and writes, which can lead to crashes or information leakage when given malformed input. This issue does not affect the handling of plain/non-hybrid PQ key operations. **Recommendations** For versions prior to 0.6.1, upgrade to version 0.6.1 to resolve the issue. At the moment, there are no other known workarounds for this issue.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 12.1 watchOS versions prior to 5.1 Safari versions prior to 12.0.1 iTunes versions prior to 12.9.1 iCloud for Windows versions prior to 7.8 **Description** The issue is related to multiple memory corruption problems that were addressed with improved memory handling. **Recommendations** For iOS versions prior to 12.1, update to version 12.1 or later. For watchOS versions prior to 5.1, update to version 5.1 or later. For Safari versions prior to 12.0.1, update to version 12.0.1 or later. For iTunes versions prior to 12.9.1, update to version 12.9.1 or later. For iCloud for Windows versions prior to 7.8, update to version 7.8 or later.