CVE-2025-55014

EUVD-2025-23543
The YouDao plugin for StarDict, as used in stardict 3.0.7+git20220909+dfsg-6 in Debian trixie and elsewhere, sends an X11 selection to the dict.youdao.com and dict.cn servers via cleartext HTTP.
Resource Leak
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.7 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 31.01%
Debian logo
Debian Releases
Debian Product
Codename
stardict
bookworm
no-dsa
forky
3.0.7+git20220909+dfsg-11
fixed
sid
3.0.7+git20220909+dfsg-11
fixed
trixie
3.0.7+git20220909+dfsg-8~deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
stardict
bionic
needs-triage
jammy
needs-triage
noble
needs-triage
plucky
ignored
questing
ignored
resolute
needs-triage
xenial
ignored
Common Weakness Enumeration
References
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1110370
https://lists.debian.org/debian-user/2025/08/msg00076.html
https://packages.debian.org/trixie/stardict
https://packages.debian.org/trixie/stardict-gtk
https://stardict-4.sourceforge.net/index_en.php
https://www.openwall.com/lists/oss-security/2025/08/04/1
http://www.openwall.com/lists/oss-security/2025/08/08/2
https://lwn.net/SubscriberLink/1032732/3334850da49689e1/
https://news.ycombinator.com/item?id=44872313