{"id":140045,"date":"2025-08-04T23:11:56","date_gmt":"2025-08-04T21:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/paket-stardict-v-debian-otpravlyaet-vydelennyj-tekst-na-vneshnie-servery"},"modified":"2025-08-04T23:11:56","modified_gmt":"2025-08-04T21:11:56","slug":"paket-stardict-v-debian-otpravlyaet-vydelennyj-tekst-na-vneshnie-servery","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/paket-stardict-v-debian-otpravlyaet-vydelennyj-tekst-na-vneshnie-servery","title":{"rendered":"The StarDict package in Debian sends highlighted text to external servers.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A privacy issue has been identified in the StarDict package available in the Debian Testing repository (the upcoming Debian 13 release), which provides an interface for searching in dictionaries. By default, the application automatically sends the selected text (x11 PRIMARY selection) to external servers. Simply highlighting any text segment in any application causes it to be sent without encryption via HTTP to Chinese online dictionary servers dict.youdao.com and dict.cn. This problem only occurs when working in environments based on the X11 protocol; when using Wayland, clipboard isolation is applied by default. <\/p>\n

The accompanying StarDict package in Debian stated that this behavior is standard. By default, StarDict has automatic dictionary search enabled for highlighted text and both local and external dictionaries activated. The servers dict.youdao.com and dict.cn provide English-Chinese dictionaries, accessed through plugins that are enabled by default when installing the stardict-plugin package, which is a recommended dependency for the stardict-gtk package. Users who are not comfortable with this behavior are advised to disable network dictionaries or the automatic search function in their settings. <\/p>\n

A user who noted the issue argued that this behavior should never be activated by default as it leads to information leakage. Users may highlight text with confidential content in applications, such as passwords and personal information. Consequently, this information not only potentially gets logged on dict.youdao.com and dict.cn and is visible to their administrators but also becomes susceptible to traffic interception due to the use of HTTP instead of HTTPS. servers<\/a> dict.youdao.com and dict.cn are visible to their administrators, but the traffic can also be intercepted due to the use of HTTP instead of HTTPS. 911565 write(16, \"GET HTTP:\/\/dict.youdao.com\/fsearch?q=selected text HTTP\/1.0\\r\\nUser-Agent: Mozilla\/4.0(compatible;MSIE 5.00;Windows 98)\\r\\nAccept: *\/*\\r\\nHost: dict.youdao.com\\r\\nConnection: close\\r\\n\\r\\n\", 171) = 171 911565 write(17, \"GET HTTP:\/\/dict.cn\/ws.php?utf8=true&q=selected text HTTP\/1.0\\r\\nUser-Agent: Mozilla\/4.0(compatible;MSIE 5.00;Windows 98)\\r\\nAccept: *\/*\\r\\nHost: dict.cn\\r\\nConnection: close\\r\\n\\r\\n\", 164) = 164 <\/p>\n

Notably, in 2009, similar behavior in StarDict was acknowledged as a vulnerability (CVE-2009-2260), and access to network dictionaries was disabled by default. Now this functionality has been restored.
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u043c \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Debian Testing (\u0431\u0443\u0434\u0443\u0449\u0438\u0439 \u0440\u0435\u043b\u0438\u0437 Debian 13) \u043f\u0430\u043a\u0435\u0442\u0435 StarDict, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0449\u0435\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u0432 \u0441\u043b\u043e\u0432\u0430\u0440\u044f\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c\u044e — \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u043e\u043c\u0435\u0449\u0430\u0435\u043c\u044b\u0439 \u0432 \u0431\u0443\u0444\u0435\u0440 \u043e\u0431\u043c\u0435\u043d\u0430 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u0442\u0435\u043a\u0441\u0442 (x11 PRIMARY selection) \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b. \u0414\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0432 \u043b\u044e\u0431\u043e\u043c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 \u0432\u044b\u0434\u0435\u043b\u0438\u0442\u044c \u043e\u0442\u0440\u044b\u0432\u043e\u043a \u0442\u0435\u043a\u0441\u0442\u0430 \u0438 \u043e\u043d \u0441\u0440\u0430\u0437\u0443 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0435\u0437 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-140045","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47The StarDict package in Debian sends highlighted text to external servers | ProHoster","description":"The StarDict package available in the Debian Testing repository (the upcoming Debian 13 release) has identified a privacy issue in its default configuration for the dictionary search interface.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/paket-stardict-v-debian-otpravlyaet-vydelennyj-tekst-na-vneshnie-servery","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0430\u043a\u0435\u0442 StarDict \u0432 Debian \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u0442\u0435\u043a\u0441\u0442 \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b | ProHoster","og:description":"\u0412 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u043c \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Debian Testing (\u0431\u0443\u0434\u0443\u0449\u0438\u0439 \u0440\u0435\u043b\u0438\u0437 Debian 13) \u043f\u0430\u043a\u0435\u0442\u0435 StarDict, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0449\u0435\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u0432 \u0441\u043b\u043e\u0432\u0430\u0440\u044f\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c\u044e - \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/paket-stardict-v-debian-otpravlyaet-vydelennyj-tekst-na-vneshnie-servery","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-08-04T21:11:56+00:00","article:modified_time":"2025-08-04T21:11:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"140045","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 14:09:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:09:19","updated":"2026-01-23 14:09:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/140045","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=140045"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/140045\/revisions"}],"predecessor-version":[{"id":164459,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/140045\/revisions\/164459"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=140045"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=140045"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=140045"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}