CVE-2011-3389: Canonical Ubuntu Linux

Medium severity, CVSS 4.3. EPSS: 73.3% chance of exploitation in the next 30 days.

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

Affected products

• Canonical Ubuntu Linux: version 10.04 only; version 10.10 only; version 11.04 only; version 11.10 only
• Debian Debian Linux: version 5.0 only; version 6.0 only
• Google Chrome: affected versions not specified
• Haxx Curl: from 7.10.6, up to and including 7.23.1
• Microsoft Internet Explorer: affected versions not specified
• Microsoft Windows: affected versions not specified
• Mozilla Firefox: affected versions not specified
• Opera Opera Browser: affected versions not specified
• Red Hat Enterprise Linux Desktop: version 5.0 only; version 6.0 only
• Red Hat Enterprise Linux Eus: version 6.2 only
• Red Hat Enterprise Linux Server: version 5.0 only; version 6.0 only
• Red Hat Enterprise Linux Server Aus: version 6.2 only
• Red Hat Enterprise Linux Workstation: version 5.0 only; version 6.0 only
• Siemens SIMATIC RF615R Firmware: before 3.2.1 (fixed in 3.2.1)
• Siemens SIMATIC RF68XR Firmware: before 3.2.1 (fixed in 3.2.1)

Published 2011-09-06. Last modified 2026-10-09.