CVE-2006-3146

The TOSRFBD.SYS driver for Toshiba Bluetooth Stack 4.00.29 and earlier on Windows allows remote attackers to cause a denial of service (reboot) via a L2CAP echo request that triggers an out-of-bounds memory access, similar to "Ping o' Death" and as demonstrated by BlueSmack. NOTE: this issue was originally reported for 4.00.23.

• CWE-119

• http://aps.toshiba-tro.de/bluetooth/pages/driverinfo.php?txt=sp2
• http://attrition.org/pipermail/vim/2006-October/001085.html
• http://briankrebswatch.blogspot.com/2006/10/more-on-toshiba-patches.html
• http://secunia.com/advisories/20657Patch, Vendor Advisory
• http://securitytracker.com/id?1016345
• http://trifinite.org/blog/archives/2006/06/update_tosiba_a.html
• http://trifinite.org/trifinite_advisory_toshiba.htmlVendor Advisory
• http://www.osvdb.org/26686
• http://www.securityfocus.com/archive/1/437811/100/0/threaded
• http://www.securityfocus.com/bid/18527Exploit
• http://www.vupen.com/english/advisories/2006/2455Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27228
• http://aps.toshiba-tro.de/bluetooth/pages/driverinfo.php?txt=sp2
• http://attrition.org/pipermail/vim/2006-October/001085.html
• http://briankrebswatch.blogspot.com/2006/10/more-on-toshiba-patches.html
• http://secunia.com/advisories/20657Patch, Vendor Advisory
• http://securitytracker.com/id?1016345
• http://trifinite.org/blog/archives/2006/06/update_tosiba_a.html
• http://trifinite.org/trifinite_advisory_toshiba.htmlVendor Advisory
• http://www.osvdb.org/26686
• http://www.securityfocus.com/archive/1/437811/100/0/threaded
• http://www.securityfocus.com/bid/18527Exploit
• http://www.vupen.com/english/advisories/2006/2455Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27228

Published

Jun 22, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-3140SQL injection vulnerability in index.php in openCI 1.0 BETA …
• CVE-2006-3141Cross-site scripting (XSS) vulnerability in details.cfm in T…
• CVE-2006-3142SQL injection vulnerability in forum.php in VBZooM 1.11 allo…
• CVE-2006-3143Cross-site scripting (XSS) vulnerability in icue_login.asp i…
• CVE-2006-3144PHP remote file inclusion vulnerability in micro_cms_files/m…
• CVE-2006-3145Buffer overflow in pamtofits of NetPBM 10.30 through 10.33 a…
• CVE-2006-3147Unspecified vulnerability in Hosting Controller before 6.1 (…
• CVE-2006-3148SQL injection vulnerability, possibly in search.inc.php, in …
• CVE-2006-3149Cross-site scripting (XSS) vulnerability in topic.php in php…
• CVE-2006-3150SQL injection vulnerability in index.php in CavoxCms 1.0.16 …
• CVE-2006-3151Cross-site scripting (XSS) vulnerability in index.php in Ass…
• CVE-2006-3152Multiple SQL injection vulnerabilities in phpTRADER 4.9 SP5 …