Pavel Avgustinov

**Name of the Vulnerable Software and Affected Versions** U-Boot versions through 2022.04 U-Boot versions through 2022.07-rc2 **Description** The issue is related to the `nfs lookup reply` function in `net/nfs.c`, which is part of the U-Boot bootloader for Linux-based embedded operating systems. It involves a buffer copy operation without proper input size validation, potentially leading to a buffer overflow. This could allow an attacker to execute arbitrary code. **Recommendations** For U-Boot versions through 2022.04, update to a version that includes a correct fix for the issue. For U-Boot versions through 2022.07-rc2, update to a version that includes a correct fix for the issue. As a temporary workaround, consider restricting access to the `nfs lookup reply` function in `net/nfs.c` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (affected versions not specified) **Description** A remote code execution issue exists in the way the Chakra scripting engine handles objects in memory. This could allow an attacker to corrupt memory and execute arbitrary code in the context of the current user, potentially gaining the same user rights as the current user. If the current user has administrative rights, an attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.