CVE-2006-6106

Multiple buffer overflows in the cmtp_recv_interopmsg function in the Bluetooth driver (net/bluetooth/cmtp/capi.c) in the Linux kernel 2.4.22 up to 2.4.33.4 and 2.6.2 before 2.6.18.6, and 2.6.19.x, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via CAPI messages with a large value for the length of the (1) manu (manufacturer) or (2) serial (serial number) field.

• CWE-119

• http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.33.5Patch
• http://marc.info/?l=linux-kernel&m=116614741607528&w=2
• http://marc.info/?l=linux-kernel&m=116648929829440&w=2
• http://rhn.redhat.com/errata/RHSA-2007-0014.html
• http://secunia.com/advisories/23408Patch, Vendor Advisory
• http://secunia.com/advisories/23427Patch, Vendor Advisory
• http://secunia.com/advisories/23593
• http://secunia.com/advisories/23609Vendor Advisory
• http://secunia.com/advisories/23752Vendor Advisory
• http://secunia.com/advisories/23997Vendor Advisory
• http://secunia.com/advisories/24098Vendor Advisory
• http://secunia.com/advisories/24105Vendor Advisory
• http://secunia.com/advisories/24206Vendor Advisory
• http://secunia.com/advisories/24547Vendor Advisory
• http://secunia.com/advisories/25226Vendor Advisory
• http://secunia.com/advisories/25683Vendor Advisory
• http://secunia.com/advisories/25691Vendor Advisory
• http://secunia.com/advisories/25714Vendor Advisory
• http://secunia.com/advisories/27227Vendor Advisory
• http://secunia.com/advisories/29058Vendor Advisory
• http://support.avaya.com/elmodocs2/security/ASA-2007-063.htm
• http://www.debian.org/security/2007/dsa-1304
• http://www.debian.org/security/2008/dsa-1503
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:002
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:012
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:025
• http://www.novell.com/linux/security/advisories/2007_18_kernel.html
• http://www.novell.com/linux/security/advisories/2007_21_kernel.html
• http://www.novell.com/linux/security/advisories/2007_30_kernel.html
• http://www.novell.com/linux/security/advisories/2007_35_kernel.html
• http://www.novell.com/linux/security/advisories/2007_53_kernel.html
• http://www.securityfocus.com/archive/1/459615/100/0/threaded
• http://www.securityfocus.com/archive/1/471457
• http://www.securityfocus.com/bid/21604
• http://www.trustix.org/errata/2007/0002/
• http://www.ubuntu.com/usn/usn-416-1
• http://www.vupen.com/english/advisories/2006/5037Vendor Advisory
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218602
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30912
• https://issues.rpath.com/browse/RPL-848
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10891
• http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.33.5Patch
• http://marc.info/?l=linux-kernel&m=116614741607528&w=2
• http://marc.info/?l=linux-kernel&m=116648929829440&w=2
• http://rhn.redhat.com/errata/RHSA-2007-0014.html
• http://secunia.com/advisories/23408Patch, Vendor Advisory
• http://secunia.com/advisories/23427Patch, Vendor Advisory
• http://secunia.com/advisories/23593
• http://secunia.com/advisories/23609Vendor Advisory
• http://secunia.com/advisories/23752Vendor Advisory
• http://secunia.com/advisories/23997Vendor Advisory
• http://secunia.com/advisories/24098Vendor Advisory
• http://secunia.com/advisories/24105Vendor Advisory
• http://secunia.com/advisories/24206Vendor Advisory
• http://secunia.com/advisories/24547Vendor Advisory
• http://secunia.com/advisories/25226Vendor Advisory
• http://secunia.com/advisories/25683Vendor Advisory
• http://secunia.com/advisories/25691Vendor Advisory
• http://secunia.com/advisories/25714Vendor Advisory
• http://secunia.com/advisories/27227Vendor Advisory
• http://secunia.com/advisories/29058Vendor Advisory
• http://support.avaya.com/elmodocs2/security/ASA-2007-063.htm
• http://www.debian.org/security/2007/dsa-1304
• http://www.debian.org/security/2008/dsa-1503
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:002
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:012
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:025
• http://www.novell.com/linux/security/advisories/2007_18_kernel.html
• http://www.novell.com/linux/security/advisories/2007_21_kernel.html
• http://www.novell.com/linux/security/advisories/2007_30_kernel.html
• http://www.novell.com/linux/security/advisories/2007_35_kernel.html
• http://www.novell.com/linux/security/advisories/2007_53_kernel.html
• http://www.securityfocus.com/archive/1/459615/100/0/threaded
• http://www.securityfocus.com/archive/1/471457
• http://www.securityfocus.com/bid/21604
• http://www.trustix.org/errata/2007/0002/
• http://www.ubuntu.com/usn/usn-416-1
• http://www.vupen.com/english/advisories/2006/5037Vendor Advisory
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218602
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30912
• https://issues.rpath.com/browse/RPL-848
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10891

Published

Dec 19, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-6100Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2006-6101Integer overflow in the ProcRenderAddGlyphs function in the …
• CVE-2006-6102Integer overflow in the ProcDbeGetVisualInfo function in the…
• CVE-2006-6103Integer overflow in the ProcDbeSwapBuffers function in the D…
• CVE-2006-6104The System.Web class in the XSP for ASP.NET server 1.1 throu…
• CVE-2006-6105Format string vulnerability in the host chooser window (gdmc…
• CVE-2006-6107Unspecified vulnerability in the match_rule_equal function i…
• CVE-2006-6108Cross-site scripting (XSS) vulnerability in EC-CUBE before 1…
• CVE-2006-6109Multiple SQL injection vulnerabilities in CandyPress Store 3…
• CVE-2006-6110Multiple SQL injection vulnerabilities in an unspecified BPG…
• CVE-2006-6111Multiple SQL injection vulnerabilities in Alan Ward A-Cart P…
• CVE-2006-6112LifeType 1.0.x and 1.1.x have insufficient access control fo…