CVE-2025-55014

MEDIUM

Published Aug 4, 2025 Modified Apr 15, 2026 CWE-402

Description

The YouDao plugin for StarDict, as used in stardict 3.0.7+git20220909+dfsg-6 in Debian trixie and elsewhere, sends an X11 selection to the dict.youdao.com and dict.cn servers via cleartext HTTP.

Is your site exposed to CVE-2025-55014?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.7

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Weakness Type (CWE)

CWE-402 CWE-402

References

Other References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1110370 https://lists.debian.org/debian-user/2025/08/msg00076.html https://packages.debian.org/trixie/stardict https://packages.debian.org/trixie/stardict-gtk https://stardict-4.sourceforge.net/index_en.php https://www.openwall.com/lists/oss-security/2025/08/04/1 http://www.openwall.com/lists/oss-security/2025/08/08/2 https://lwn.net/SubscriberLink/1032732/3334850da49689e1/ https://news.ycombinator.com/item?id=44872313

Frequently Asked Questions

What is CVE-2025-55014? +

The YouDao plugin for StarDict, as used in stardict 3.0.7+git20220909+dfsg-6 in Debian trixie and elsewhere, sends an X11 selection to the dict.youdao.com and dict.cn servers via cleartext HTTP. It has a CVSS v3.1 base score of 4.7 (MEDIUM).

How severe is CVE-2025-55014? +

CVE-2025-55014 has a CVSS v3.1 score of 4.7 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

How do I check if I'm vulnerable to CVE-2025-55014? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-0502 9.1

Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 …

CVE-2025-48383 8.2

Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget …

CVE-2024-29900 7.5

Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. …

CVE-2025-67745 7.1

MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version 1.3.0, …

CVE-2024-47146 6.5

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to obtain the devices serial …

CVE-2025-49618 5.8

In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.