Filtered by vendor St Subscriptions
Total 22 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-50096 1 St 1 X-cube-safea1 2024-11-21 7.5 High
STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. This is caused by an StSafeA_ReceiveBytes buffer overflow in the X-CUBE-SAFEA1 Software Package for STSAFE-A sample applications (1.2.0), and thus can affect user-written code that was derived from a published sample application.
CVE-2023-36629 1 St 1 St54-android-packages-apps-nfc 2024-11-21 5.5 Medium
The ST ST54-android-packages-apps-Nfc package before 130-20230215-23W07p0 for Android has an out-of-bounds read.
CVE-2021-43393 1 St 4 J-safe3, J-safe3 Firmware, Stsafe-j and 1 more 2024-11-21 6.2 Medium
STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to abuse signature verification. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform.
CVE-2021-43392 1 St 4 J-safe3, J-safe3 Firmware, Stsafe-j and 1 more 2024-11-21 6.2 Medium
STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to obtain information on cryptographic secrets. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform.
CVE-2021-42553 1 St 1 Stm32 Mw Usb Host 2024-11-21 6.8 Medium
A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in versions before 3.5.1 allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH_MAX_NUM_ENDPOINTS. The library is typically integrated when using a RTOS such as FreeRTOS on STM32 MCUs.
CVE-2021-34268 1 St 2 Stm32cube Middleware, Stm32h7b3 2024-11-21 4.6 Medium
An issue in the USBH_ParseDevDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) via a malformed USB device packet.
CVE-2021-34267 1 St 2 Stm32cube Middleware, Stm32h7b3 2024-11-21 4.6 Medium
An in the USBH_MSC_InterfaceInit() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) when the system tries to communicate with the connected endpoint.
CVE-2021-34262 1 St 2 Stm32cube Middleware, Stm32h7b3 2024-11-21 6.8 Medium
A buffer overflow vulnerability in the USBH_ParseEPDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbitrary code.
CVE-2021-34261 1 St 2 Stm32cube Middleware, Stm32h7b3 2024-11-21 4.6 Medium
An issue in USBH_ParseCfgDesc() of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service due to the system hanging when trying to set a remote wake-up feature.
CVE-2021-34260 1 St 2 Stm32cube Middleware, Stm32h7b3 2024-11-21 6.8 Medium
A buffer overflow vulnerability in the USBH_ParseInterfaceDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbitrary code.
CVE-2021-34259 1 St 2 Stm32cube Middleware, Stm32h7b3 2024-11-21 6.8 Medium
A buffer overflow vulnerability in the USBH_ParseCfgDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbitrary code.
CVE-2021-29414 1 St 95 Stm32cubel4 Firmware, Stm32l412c8, Stm32l412cb and 92 more 2024-11-21 6.1 Medium
STMicroelectronics STM32L4 devices through 2021-03-29 have incorrect physical access control.
CVE-2020-8004 1 St 2 Stm32f1, Stm32f1 Firmware 2024-11-21 7.5 High
STMicroelectronics STM32F1 devices have Incorrect Access Control.
CVE-2020-27212 1 St 95 Stm32cubel4 Firmware, Stm32l412c8, Stm32l412cb and 92 more 2024-11-21 7.0 High
STMicroelectronics STM32L4 devices through 2020-10-19 have incorrect access control. The flash read-out protection (RDP) can be degraded from RDP level 2 (no access via debug interface) to level 1 (limited access via debug interface) by injecting a fault during the boot phase.
CVE-2020-20949 2 Ietf, St 22 Public Key Cryptography Standards \#1, Stm32cubef0, Stm32cubef1 and 19 more 2024-11-21 5.9 Medium
Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.
CVE-2020-13466 1 St 2 Stm32f103, Stm32f103 Firmware 2024-11-21 6.8 Medium
STMicroelectronics STM32F103 devices through 2020-05-20 allow physical attackers to execute arbitrary code via a power glitch and a specific flash patch/breakpoint unit configuration.
CVE-2019-19192 1 St 2 Bluenrg-2, Wb55 2024-11-21 6.5 Medium
The Bluetooth Low Energy implementation on STMicroelectronics BLE Stack through 1.3.1 for STM32WB5x devices does not properly handle consecutive Attribute Protocol (ATT) requests on reception, allowing attackers in radio range to cause an event deadlock or crash via crafted packets.
CVE-2019-16863 1 St 8 St33tphf20i2c, St33tphf20i2c Firmware, St33tphf20spi and 5 more 2024-11-21 5.9 Medium
STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA scalar multiplication is mishandled, aka TPM-FAIL.
CVE-2019-14238 1 St 12 Stm32f4, Stm32f4 Firmware, Stm32f7 and 9 more 2024-11-21 6.6 Medium
On STMicroelectronics STM32F7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated with a debug probe via the Instruction Tightly Coupled Memory (ITCM) bus.
CVE-2019-14236 1 St 12 Stm32f4, Stm32f4 Firmware, Stm32f7 and 9 more 2024-11-21 9.8 Critical
On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated by observing CPU registers and the effect of code/instruction execution.