/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 7830 by nion, Fri Jan 4 18:01:23 2008 UTC revision 13396 by jwilk-guest, Sat Nov 28 21:49:29 2009 UTC
# Line 1  Line 1 
1  Embedded code copies  Embedded code copies
2  ====================  ====================
3    
4  This file collects cases, where a source package embeds code from  This file collects source packages that embed code from other projects.
5  other projects which is considered bad for fixing security flaws  This is considered bad for fixing security flaws because the fix needs
6  because the fix needs to be applied in multiple source packages.  to be applied in multiple source packages.
7    
8  Format:  Format:
9  <srcpkg> (<optional comment about srcpkg>)  <srcpkg> (<optional comment about srcpkg>)
10          - <embedding srcpkg> <status> (<sort>; bug #<number>)          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11          NOTE: optional comments about the linkage of the embedding srcpkg          NOTE: optional comments about the linkage of the embedding srcpkg
12    
13  status: version number fixing the embedded copy, <unfixed>, <removed> or <unknown> if the version number can not be determined  status: version number fixing the embedded copy, <unfixed>, <removed>,
14            <itp>, <not-affected>, <unknown> if the version number can not
15            be determined, or <unfixable> for unavoidable cases (e.g., forks
16            that add real value)
17  sort: static (linking statically against a lib)  sort: static (linking statically against a lib)
18        embed (embedding a copy of the library into another source package)        embed (embedding a copy of the library into another source package)
19        fork (the package is not just embedding code but it is a fork and thus might share parts of the source code)        fork (the package is not just embedding code but it is a fork and
20                thus might share parts of the source code)
21          old-version (the package is an older version of essentially
22                       the same code)
23    
24  The srcpkg might be some string to identify the code if there is no specific source package.  The srcpkg might be some string to identify the code if there is no
25    specific source package.
26    
27    Everything up to the next line is ignored.
28    ---BEGIN
29  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
30          NOTE: Fixed packages link to poppler library unless otherwise noted          NOTE: Fixed packages link to poppler library unless otherwise noted
         - gpdf <removed>  
         [sarge] - gpdf <unfixed>  
         NOTE: has been replaced by evince in etch  
31          - pdftohtml <unknown>          - pdftohtml <unknown>
32          [sarge] - pdftohtml <unfixed>          [sarge] - pdftohtml <unfixed>
33          [etch] - pdftohtml <unfixed>          [etch] - pdftohtml <unfixed>
34          NOTE: has been replaced by poppler-utils          NOTE: has been replaced by poppler-utils
35          - kdegraphics <unfixed> (embed; bug #436164)          - kdegraphics 4:4.2.2-1 (embed; bug #436164)
36          NOTE: the kpdf replacement in KDE 4 is using poppler          - texlive-base 3.0-12 (embed)
         - tetex-bin 3.0-12 (embed)  
37          - texlive-bin 2007-1 (embed)          - texlive-bin 2007-1 (embed)
38          NOTE: links to poppler          NOTE: links to poppler
39          - koffice <unfixed> (embed; bug #436163)          - koffice <unfixed> (embed; bug #436163)
40          - libextractor 0.5.12-1 (embed)          - libextractor 0.5.12-1 (embed)
41          NOTE: libextractor is using its own pdf decoder now          NOTE: libextractor is using its own pdf decoder now
         - libextractor 0.5.12-1 (embed)  
         - pdfkit.framework 0.8-4 (embed)  
42          - ipe <unfixed> (embed)          - ipe <unfixed> (embed)
43          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
44          - ruby-gnome2 <unknown> (embed)          - ruby-gnome2 <unknown> (embed)
45          NOTE: copy only present in source but links to poppler          NOTE: copy only present in source but links to poppler
46            - pdfedit <unfixed> (embed; bug #510794)
47            - swftools <unfixed> (embed; bug #551293)
48            - poppler <unfixable> (fork)
49    
50  ppmd  ppmd
51          - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)          - libcomplearn-mod-ppmd <unfixed> (fork)
52            NOTE: discussion in #458152
53    
54    libevent
55            - transmission 1.71-1 (embed; bug #529372)
56    
57    lrmi
58            - read-edid 2.0.0-1 (embed; bug #495131)
59    
60    peercast
61            - gnome-peercast <removed> (embed)
62            [etch] - gnome-peercast <unfixed> (embed)
63    
64  silc-toolkit  silc-toolkit
65          - silc-client 1.1~beta6-1 (embed)          - silc-client 1.1~beta6-1 (embed)
66    
67    icclib
68            - ghostscript <unfixed> (embed)
69            - argyll <unfixed> (embed)
70    
71  dietlibc  dietlibc
72          - ccontrol 0.9.1+20071204-1 (static)          - ccontrol 0.9.1+20071204-1 (static)
73    
74    libmikmod
75            - sdl-mixer1.2 <unfixed> (embed)
76            TODO: report bug
77    
78  libiax  libiax
79          - iaxmodem <unfixed> (embed)          - iaxmodem <unfixable> (embed; bug #548885)
80    
81    spandsp
82            - iaxmodem <unfixable> (embed; bug #548885)
83    
84  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
85          - dpkg <unfixed> (embed)          - dpkg <unfixed> (embed)
# Line 64  zlib (lots of apps embed a copy, but lin Line 92  zlib (lots of apps embed a copy, but lin
92          - pvpgn 1.7.8-2 (embed)          - pvpgn 1.7.8-2 (embed)
93          - mrtg 2.12.2-1 (embed)          - mrtg 2.12.2-1 (embed)
94          - rpm <unknown> (embed)          - rpm <unknown> (embed)
95          NOTE: pinged joeyh since when rpm was fixed          NOTE: pinged anibal since when rpm was fixed
96            - tuxcmd-modules <unfixed> (embed)
97            - zsync <unfixed>
98            - tra <unfixed>
99            - sash <unfixed>
100            - nsis <unfixed>
101            - mseide-msegui <unfixed>
102            NOTE: mseide
103            - mirrordir <unfixed>
104            - poco <unfixed>
105            - klibc <unfixed>
106            - ghostscript <unfixed>
107            - freeimage <unfixed>
108            - clamav <unfixed> (fork)
109            NOTE: from the changelog: "libclamav6 does indeed duplicate parts of the zlib code, but there is not way around that"
110            - tuxonice-userui <unfixed>
111            - plt-scheme <unfixed>
112            - perl <unfixed>
113            - paraview <unfixed>
114            - gcvs <unfixed>
115            - dump <unfixed>
116            - aide <unfixed> (static)
117            - dar <unfixed> (static)
118            - avfs <unfixed>
119            - fpc <unfixed>
120            - winff <unfixed>
121            NOTE: inherited from fpc, see #472304
122            - lazarus <unfixed>
123            NOTE: inherited from fpc, see #472304
124            - erlang <unfixed> (embed)
125            - gamera 3.2.3-1 (embed)
126            - python2.4 <unfixed> (embed; bug #553403)
127            - python2.5 <unfixed> (embed; bug #553403)
128    
129    dulwich
130            - hg-git 0.1.0-1 (embed; bug #541996)
131    
132    libvigraimpex
133            - hugin <unfixed> (embed; bug #542259)
134            - enblend-enfuse <unfixed> (embed; bug #542258)
135            - gamera 3.2.3-1 (embed)
136    
137  libbz2  libbz2
138          - dpkg <unfixed> (static)          - dpkg <unfixed> (static)
139    
140  ekg  libgadu
141          - centericq <unfixed> (embed)          - centericq <unfixed> (embed)
142          - gaim <unfixed> (embed)          - pidgin <not-affected> (links dynamically since initial release; fixed in gaim)
143          - pigdin <unfixed> (embed)(links dynamically against libgadu)          - gaim 1:2.0.0+beta3-3 (embed; bug #360280)
144          - kopete 4:3.3.2-5 (embed)          - kdenetwork 4:3.3.2-5 (embed)
145          - kadu <unfixed> (embed)          NOTE: from kdenetwork: kopete
146          - gadu <unfixed> (embed)          - ekg 1:1.8~rc0-1 (embed)
147          NOTE: g/kadu not packaged in Debian yet          - kadu 0.6.0.2-3 (embed; bug #504430)
148            - gadu <itp> (embed)
149    
150  xmlrpc (which package is the "origin" of this code?)  xmlrpc (which package is the "origin" of this code?)
151          - drupal <unfixed> (embed)          - drupal <unfixed> (embed)
152          - phpgroupware <unfixed> (embed)          - phpgroupware <unfixed> (embed)
153          - egroupware <unfixed> (embed)          - egroupware <unfixed> (embed)
154          - phpwiki (embed)          - phpwiki <unfixed> (embed)
155          - php4 <unfixed> (embed)          - php4 <unfixed> (embed)
156          TODO: check, php-pear, IIRC this was reorganized some weeks ago?          TODO: check, php-pear, IIRC this was reorganized some weeks ago?
157    
# Line 90  shtool (affects build-time only) Line 159  shtool (affects build-time only)
159          - mysql-ocaml <unfixed> (embed)          - mysql-ocaml <unfixed> (embed)
160          - php4 <unfixed> (embed)          - php4 <unfixed> (embed)
161    
162  mozilla source code  iceape
163          - mozilla-firefox <unfixed> (embed)          - iceweasel <unfixed> (fork)
164          - mozilla-thunderbird          - icedove <unfixed> (fork)
165          - firefox <removed>          - xulrunner <unfixed> (fork)
166          [etch] - firefox <unfixed> (embed)          - kompozer <unfixed> (embed; bug #532168)
167          - thunderbird <removed>          - galeon <unfixed> (fork)
168          [etch] - thunderbird <unfixed> (embed)          - epiphany-browser <unfixed> (fork)
169          - iceweasel <unfixed> (embed)          - conkeror <unfixed> (fork)
170          - iceape <unfixed> (embed)          - kazehakase <unfixed> (fork)
         - icedove <unfixed> (embed)  
         - xulrunner <unfixed> (embed)  
         - nvu <removed> (embed)  
171    
172  xli  xli
173          - xloadimage <unfixed> (embed)          - xloadimage <unfixed> (embed)
174    
175  lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)  lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
176          - openmotif <unfixed> (embed)          - openmotif <unfixed> (embed)
177          - xfree86/xorg <unfixed> (embed)          - libxpm <unfixed> (embed)
         NOTE: in libxpm  
178    
179  kerberized apps with BSD origin  kerberized apps with BSD origin
180          - krb4 <unfixed> (embed)          - krb4 <removed> (embed)
181          - krb5 <unfixed> (embed)          - krb5 <unfixed> (embed)
182          - heimdal <unfixed> (embed)          - heimdal <unfixed> (embed)
183    
184  grip (which pkg is the origin?)  grip (which pkg is the origin?)
185          - libcdaudio          - libcdaudio <unfixed>
186          - grip          - grip <unfixed>
187          - gnome-vfs          - gnome-vfs <unfixed>
188          TODO: check vfs2 as well          TODO: check vfs2 as well
189    
190  fudforum  fudforum
191          - phpgroupware-fudforum <unfixed> (embed)          [etch] - phpgroupware <unfixed> (embed)
192          - egroupware-fudforum <removed>          NOTE: phpgroupware-fudforum
193          [sarge] - egroupware-fudforum <unfixed> (embed)          [sarge] - egroupware-fudforum <removed> (embed)
194    
195    libbsd
196            - rdate 1:1.2-3 (embed)
197            - atheme-services <unfixed>
198            - libbsd-arc4random-perl <unfixed>
199            - isakmpd <unfixed>
200    
201  cvs  cvs
202          - gcvs <unfixed> (embed)          - gcvs <unfixed> (embed)
203          NOTE: see cvsunix/src in tarball          NOTE: see cvsunix/src in tarball
204    
205  pcre  pcre3
         - python* <unfixed> (embed)  
206          - php4 <unknown> (embed)          - php4 <unknown> (embed)
207          - analog 2:5.23-0woody1 (embed)          - analog 2:5.23-0woody1 (embed)
208          - libgoffice-1 <unfixed> (embed)          - goffice <unfixed> (embed)
209            NOTE: libgoffice-*
210          - vfu 4.06-4.1 (embed; bug #450754)          - vfu 4.06-4.1 (embed; bug #450754)
211          - tf5 5.0beta7-1 (embed)          - tf5 5.0beta7-1 (embed)
212          - monotone <unfixed> (embed)          - monotone 0.43-1 (embed)
213          NOTE: this only affects versions >= 0.37          NOTE: this only affects versions >= 0.37
214          - glib <unfixed> (embed)          - glib2.0 2.15.2-1 (embed)
         NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic  
215          - apache2 2.0.53-4 (embed)          - apache2 2.0.53-4 (embed)
216          - exim4 4.10-0.srh20.12 (embed)          - exim4 4.10-0.srh20.12 (embed)
217          - yacas <unfixed> (embed)          - yacas <unfixed> (embed)
218          NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway          NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
219          - gtamsanalyzer.app 0.42-5 (embed)          - gtamsanalyzer.app 0.42-5 (embed)
220            - tin 980117-1 (embed)
221            - kazehakase 0.5.2-1
222            - webkit 1.0.1-1 (embed)
223            - qt4-x11 <unfixed> (embed)
224            NOTE: embedded via webkit copy
225            - erlang <unfixed> (embed)
226    
227  tiff  tiff
228          - wxpythongtk <unfixed> (embed)          - wxwindows2.4 2.2.1 (embed)
229          TODO: check, which debian pkg this is in          - gamera 3.2.3-1 (embed)
230    
231  uudeview  uudeview
232          - libconvert-uulib-perl <unfixed> (embed)          - libconvert-uulib-perl <unfixed> (embed)
233            - pan <unfixed> (embed)
234    
235  sqlite (not affected by security vulnerabilities so far)  sqlite (not affected by security vulnerabilities so far)
236          - amarok <unfixed> (embed)          - amarok <unfixed> (embed)
237          - monotone <unfixed> (embed)          - monotone 0.43-1 (embed)
238          - iceweasel <unfixed> (embed)          - iceweasel <unfixed> (embed)
239    
240  util-linux/mount  util-linux/mount
241          - loop-aes-utils <unfixed> (embed)          - loop-aes-utils <unfixed> (embed)
242          NOTE: contains code from util-linux' mount in the mount-aes-udeb          NOTE: contains code from util-linux' mount in the mount-aes-udeb
243    
 webmin  
         - usermin <unknown> (embed)  
         [sarge] - usermin <unfixed> (embed)  
   
244  sylpheed  sylpheed
245          - sylpheed-claws <unfixed> (fork)          - sylpheed-claws <unfixed> (fork)
246    
# Line 176  phpsysinfo Line 249  phpsysinfo
249          - phpgroupware <unfixed> (embed)          - phpgroupware <unfixed> (embed)
250    
251  phpldapadmin  phpldapadmin
252          - [sarge] egroupware <unfixed> (embed)          [sarge] - egroupware <unfixed> (embed)
253          NOTE: removed from egroupware after sarge          NOTE: removed from egroupware after sarge
254    
255  chmlib  chmlib
256          - kchmviewer <unknown> (embed)          - kchmviewer <unknown> (embed)
257    
258  libavcodec/libavformat (source: ffmpeg)  ffmpeg (libavcodec/libavformat)
259          - mplayer <unfixed> (embed; bug #395252)          - mplayer 1.0~rc2-14 (embed; bug #395252)
260          - xvidcap <unfixed> (embed)          - kino 1.0.0-1
261          - kino <unfixed> (static)          - vlc <not-affected> (Links dynamically since initial release)
262          - vlc <unfixed> (static)          - smilutils 0.3.0-10
263          - smilutils <unfixed> (static)          NOTE: smilutils likely fixed earlier, marking Etch's version as fixed
264          - motion <unfixed> (static)          - motion 3.1.19-1
265          - gst-ffmpeg <unfixed> (embed)          - gstreamer0.10-ffmpeg 0.10.3-2
266          - gstreamer0.10-ffmpeg <unfixed> (embed)          - xmovie <removed> (static)
267          - xmovie <unfixed>          TODO: gimp-gap (potentially using ffmpeg code as well)
268            - avifile 1:0.7.48~20090503.ds-1 (embed; bug #538750)
269    
270    faad2
271            - mplayer 1.0~rc2-20 (embed)
272            - avifile <unfixed> (embed; bug #538750)
273            - ffmpeg-debian <removed> (old-version)
274    
275  mad MPEG decoding lib  libmad (MPEG decoding lib)
         - mad <unfixed> (embed)  
276          - xine-lib <unfixed> (embed)          - xine-lib <unfixed> (embed)
277            - avifile 1:0.7.48~20090503.ds-1 (embed) [./plugins/libmad/*]
278            TODO: check ocaml-mad, madplay, pymad, xmms-mad, xmms2
279    
 libdts:  
280  libdts  libdts
281  xine-lib          - xine-lib <unfixed> (embed)
282    
 flac:  
283  flac  flac
284  xine-lib          - xine-lib <unfixed> (embed)
   
 liba52:  
 a52dec  
 xine-lib  
285    
286  libmpeg2:  liba52
287  mpeg2dec          - a52dec <unfixed> (embed)
288  xine-lib          - xine-lib <unfixed> (embed)
289    
290  curl:  libmpeg2
291  wget (code for NTLM authentication)          - mpeg2dec <unfixed> (embed)
292            - xine-lib <unfixed> (embed)
293    
294  TODO evaluate:  libntlm
295  gimp-gap (potentially using ffmpeg code as well)          - wget <unfixed> (fork; bug #550436)
296            - curl <unfixed> (fork; bug #550437)
297            - cntlm <unfixed> (fork; bug #550438)
298    
299  uw-imap:  uw-imap
300  pine          - pine <unfixed> (embed)
301  alpine          - alpine <unfixed> (embed)
302    
303  imagemagick:  imagemagick
304  graphicsmagick          - graphicsmagick <unfixed> (fork)
305    
306  halibut:  python-urlgrabber
307  nsis          - mercurial <unfixed> (embed; bug #531062)
308            - w3af <unfixed> (embed; bug #555372)
309            [experimental] - harvestman <unfixed> (embed; bug #555373)
310    
311  libghttp:  beautifulsoup
312  hotway          - python-mechanize <unfixed> (embed; bug #555349)
313            - zope2.11 <unfixed> (embed; bug #555350)
314            - twill <unknown> (embed)
315    
316  libsndfile:  halibut
317  ardour          - nsis <unfixed> (fork)
318    
319  glibmm2.4:  libghttp
320  ardour          - hotway <unfixed> (embed)
321    
322  libgnomecanvasmm2.6:  libsndfile
323  ardour          - ardour 1:2.7.1-1 (embed)
324    
325  libsigc++-2.0:  glibmm2.4
326  ardour          - ardour 1:2.7.1-1 (embed)
327    
328  soundtouch:  libgnomecanvasmm2.6
329  ardour          - ardour 1:2.7.1-1 (embed)
330    
331  libmms:  libsigc++-2.0
332  xine-lib          - ardour 1:2.7.1-1 (embed)
 mimms  
333    
334  FCKeditor: (packaged as fckeditor)  soundtouch
335  knowledgeroot          - ardour 1:2.7.1-1 (embed)
 moin (452599)  
 karrigell (452598)  
 gforge-plugins-extra (fixed since 4.6.99+svn6225-1)  
336    
337    libmms
338            - xine-lib <unfixed> (embed)
339            - mimms <unfixed> (embed)
340    
341    fckeditor
342            - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
343            - moin 1.8.2-2 (embed; bug #452599)
344            - karrigell <removed> (embed; bug #452598)
345            - gforge 4.6.99+svn6225-1 (embed)
346            - request-tracker3.8 <unfixed> (embed)
347    
348    ipatlas (not packaged in Debian)
349            - moodle <unfixed> (embed; bug #507185)
350    
351    libphp-phpmailer
352            - moodle <unfixed> (embed; bug #507185)
353            - mahara <unfixed> (embed)
354            - symfony <unfixed> (embed)
355            [etch] - phpgroupware <unfixed> (embed)
356            NOTE: phpgroupware-felamimail is only in etch
357            - egroupware <unfixed> (embed; bug #504283)
358            - glpi <unfixed>
359    
360    htmlArea (not packaged in Debian)
361            - moodle <unfixed> (embed)
362    
363    giflib
364            - wine <unfixed> (embed; bug #466181)
365    
366    bennu (not packaged in Debian, http://bennu.sourceforge.net)
367            - moodle <unfixed> (embed)
368    
369    smarty
370            - moodle 1.8.2-2 (embed; bug #471158)
371            - gallery2 2.2.5-2 (embed; bug #471160)
372            - mahara 0.9.2-2 (embed; bug #471201)
373            - gosa 2.4beta1-1 (embed; bug #471200)
374    
 Moodle contains lots of things:  
 AdoDB  
 AdoDB-XML Schema  
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
375  TinyMCE  TinyMCE
376  bennu          - wordpress 2.5.1-3 (embed; bug #478257)
377            - moodle <unfixed> (embed; bug #507185)
378            - knowledgeroot <unfixed> (embed)
379            - joomla <itp> (bug #326398)
380    
381    scintilla (upstream provides static lib, rejected shared lib http://sf.net/support/tracker.php?aid=2488121)
382            - scite <unfixed> (embed)
383            - qscintilla <unfixed> (embed)
384            - qscintilla2 <unfixed> (embed)
385            - geany <unfixed> (fork)
386            - anjuta <unfixed> (embed)
387    
388    libphp-adodb
389            - moodle <unfixed> (embed; bug #507185)
390            NOTE: also AdoDB-XML Schema
391            - gallery2 <unfixed> (embed)
392            - phppgadmin <unfixed> (embed)
393            - egroupware <unfixed> (embed)
394            - phpwiki <unfixed> (embed)
395            - torrentflux 2.0beta1-2 (embed)
396            - ipplan <unfixed> (embed)
397            - typo3-src <unfixed> (embed)
398            - cacti <unknown> (embed)
399            [sarge] - cacti <unfixed> (embed)
400            NOTE: dependency exists, but internal version is used
401            - gforge 4.7~rc2-6 (embed)
402            - mahara <unfixed> (embed)
403    
404    gzip
405            - linux-kernel <unfixed> (embed)
406            NOTE: lib/inflate.c
407            - klibc <unfixed> (embed)
408            NOTE: based on linux-kernel gzip code
409            - busybox <unfixed> (embed)
410    
411    neon
412            - cadaver 0.22.3+debian-1 (embed; bug #188381)
413            - gnome-vfs2 <unfixed> (embed; bug #395874)
414            [etch] - litmus <unfixed> (embed; #395875)
415            - litmus <removed> (embed; #395875)
416            [sarge] - screem <unfixed> (embed)
417            - sitecopy 1:0.16.3-5 (embed; bug #395876)
418            [etch] - tla <unfixed> (embed; bug #395877)
419            [sarge] - tla <unfixed> (embed; bug #395877)
420    
421    libmodplug
422            - gst-plugins-bad0.10 <unfixed> (embed)
423    
424    libvncserver
425            - vino <unfixed> (embed)
426    
427    putty
428            - filezilla <unfixed> (embed)
429    
430    tinyxml (not packaged in Debian)
431            - filezilla <unfixed>
432    
433    gv
434            - evince <unfixed> (embed)
435            NOTE: ps/ tree from gv 3.5.8
436            NOTE: evince-gtk is affected (a component of evince source package)
437    
438    libXbae
439            - paw <removed> (embed)
440            [etch] - paw <unfixed> (embed)
441    
442    libgtkhtml
443            - claws-mail-extra-plugins <unfixed> (fork)
444    
445    libXaw
446            - paw <removed> (embed)
447            [etch] - paw <unfixed> (embed)
448            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
449    
450    libgd2
451            - graphviz <unfixed> (embed)
452            NOTE: lib/gd seems to be 2.0.33
453            - wml <unfixed> (embed)
454            - libwmf <unfixed> (embed)
455            NOTE: derived from gd 1.6.3
456    
457    rar
458            - unrar-nonfree <unfixed> (embed)
459    
460    unrar-free (maybe this code is derived from the original rar, too?)
461            - clamav <unfixed> (embed)
462            NOTE: seems to be disabled in default config
463    
464  TinyMCE:  mplayer (DirectMedia Object loader)
465  wordpress          - xine-lib <unfixed> (embed)
466  moodle          NOTE: src/libw32dll/
467  knowledgeroot          - vlc <unfixed> (embed)
468  joomla (ITP)          NOTE: modules/codec/dmo/
469            - mplayer 1.0~rc2-20 (embed)
470  scintilla:  
471  scite  libwpd (WordPerfect converter)
472  qscintilla          - openoffice.org <unfixed> (embed)
473  qscintilla2  
474  geany  fsplib (http://sourceforge.net/projects/fsp/)
475            - gftp <unfixed> (embed)
476  libphp-adodb:          NOTE: lib/fsplib version 0.3
 gallery2  
 phppgadmin  
 egroupware  
 phpwiki  
 ipplan  
 typo3  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
477    
478  gzip:  sprng
479  linux-kernel (lib/inflate.c)          - tree-puzzle <unfixed> (embed)
 klibc (based on linux-kernel gzip code)  
 busybox  
480    
481  neon:  librpcsecgss
482  cadaver (all, but being worked on: #188381)          - krb5 <unfixed> (embed)
 gnome-vfs2 (#395874)  
 litmus (#395875)  
 screem (sarge only)  
 sitecopy (#395876)  
 tla (etch/sid only: #395877)  
483    
484  libmodplug:  jasper
485  gst-plugins-bad0.10          - ghostscript <unfixed> (embed)
486            - gs-gpl <unfixed> (embed)
487    
488    libiris
489            - psi <unfixed> (embed)
490            - kdenetwork <unfixed> (embed)
491            NOTE: kopete embeds libiris but links dynamically to libidn
492            - kdegames <unfixed> (embed)
493            NOTE: ksirk/kde4
494    
495    libidn
496            - monotone 0.43-1 (embed)
497            - psi <unfixed> (embed)
498            NOTE: psi embeds libiris which embeds libidn
499            - kdegames <unfixed> (embed)
500            NOTE: kdegames/kde4 embeds libiris which embeds libidn
501    
502    liblua
503            - monotone 0.43-1 (embed)
504            - nmap 5.00-1 (embed; bug #527997)
505            [lenny] - nmap <unfixed> (embed; bug #527997)
506            - ocropus <unfixed> (embed)
507    
508  libvncserver:  libbotan
509  vino          - monotone 0.43-1 (embed)
510    
511  putty:  NetXX
512  filezilla          - monotone 0.43-1 (embed)
513    
514  tinyxml (not packaged in Debian):  libgc
515  filezilla          - mono <unfixed> (embed)
516    
517  gv:  lzma
518  evince (ps/ tree from gv 3.5.8)          - p7zip <unfixed> (embed)
519  evince-gtk (not packaged in Debian)          - xz-utils <unfixed> (fork)
520    
521    lzo
522            - grub2 <unfixed> (embed)
523    
524    yassl
525            - mysql-dfsg-5.0 <unfixed> (embed)
526    
527    pax code
528            - tar <unfixed> (embed)
529            - cpio <unfixed> (embed)
530    
531    t1lib
532            - tetex-bin 2.0.2-1 (embed)
533            - texlive-bin <unknown> (embed)
534    
535    guichan
536            - boswars <unfixed> (embed)
537            NOTE: maintainer notified us, working on it
538    
539    tolua
540            - boswars <unfixed> (embed)
541            NOTE: maintainer notified us, working on it
542            - ocropus <unfixed> (embed)
543            - freeciv <unfixed> (embed)
544    
545  libXbae:  asio-dev
546  libpawlib2-lesstif package (from Cernlib)          - luxrender <removed> (embed)
547    
548  libXaw:  xine-lib
549  libpawlib2-lesstif package (from Cernlib)          - vlc <unfixed> (embed)
550            NOTE: only parts included in modules/access/rtsp
551    
552  (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  netpbm
553            - tcl8.3 <unfixed> (embed)
554            - tcl8.4 <unfixed> (embed)
555            - tcl8.5 <unfixed> (embed)
556            NOTE: generic/tkImgGIF.c
557    
558    tk8.5
559            - tk8.0 <removed> (old-version)
560            - tk8.3 <unfixed> (old-version)
561            - tk8.4 <unfixed> (old-version)
562            - perl-tk <unfixable> (fork)
563    
564    samba
565            - mc 2:4.6.2~git20080311-1 (embed)
566            NOTE: maintainer is aware of this, currently searching a solution
567    
568    plib1.8.4c2
569            - boson <unfixed> (fork)
570            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
571    
572    fribidi
573            - quesoglc <unfixed> (embed)
574            NOTE: compiled against system fribidi in Debian - embed only used when fribidi is not available on the system
575    
576    glew
577            - quesoglc <unfixed> (embed; bug #489341)
578            NOTE: waiting on GLEW_MX version of glew (see bug #474488)
579    
580    minorGems (pabs contacted upstream about shared lib, he considers minorGems an 'ever-evolving collection of reusable code fragments' for his own use)
581            - transcend <unfixed> (embed)
582            - cultivation <unfixed> (embed)
583            - passage <unfixed> (embed)
584            - gravitation <unfixed> (embed)
585    
586  libgd2:  tar
587  graphviz (lib/gd seems to be 2.0.33)          - libarchive <unfixed> (embed)
588            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
589    
590  rar:  cpio
591  unrar-nonfree          - libarchive <unfixed> (embed)
592            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
593    
594  unrar-free: (maybe this code is derived from the original rar, too?)  webkit
595  clamav (seems to be disabled in default config)          - qt4-x11 <unfixed> (embed)
596    
597  mplayer (DirectMedia Object loader):  ftgl
598  xine-lib (src/libw32dll/)          - blender 2.46+dfsg-1 (embed)
 vlc (modules/codec/dmo/)  
599    
600  libwpd (WordPerfect converter):  wv
601  openoffice.org          - abiword <unfixed>
602    
603  fsplib (http://sourceforge.net/projects/fsp/):  qemu
604  gftp (lib/fsplib version 0.3)          - kvm <unfixed> (embed; bug #543159)
605            - xen-3 <unfixed> (embed)
606            - xen-unstable <unfixed> (embed)
607    
608  librpcsecgss:  vgabios
609  krb5          - kvm <unfixed> (embed; bug #489442)
610    
611  jasper:  bochs
612  ghostscript          - kvm <unfixed> (embed; bug #489442)
 gs-gpl  
613    
614  libidn:  speex
615  monotone          - vorbis-tools <unfixed> (embed)
616            NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
617            - gst-plugins-good0.10 <unfixed> (embed)
618            - xine-lib <unfixed> (embed)
619            - libfishsound <unfixed> (embed)
620            - libannodex <unfixed> (embed)
621            - vlc <unfixed> (embed)
622            - xmms-speex <unfixed> (embed)
623            - libsdl-sound1.2 <unfixed> (embed)
624            - sweep <unfixed> (embed)
625    
626    libreadline
627            - magic <itp> (old-version)
628    
629    opcode
630            - ode <unfixed> (embed)
631            NOTE: opcode is not a package in debian, it is just embedded
632            NOTE: http://www.codercorner.com/Opcode.htm
633    
634    gimpact
635            - ode <unfixed> (embed)
636            NOTE: gimpact is not a package in debian, it is just embedded
637            NOTE: http://gimpact.sf.net
638    
639    mochikit
640            - mahara <unfixed> (embed)
641            NOTE: they require extra patches, still unmerged upstream
642            - ntop <unfixed> (embed)
643            - coherence 0.6.2-1 (embed)
644            - paste <unfixed> (embed)
645            - turbogears <unfixed> (embed)
646            - plone3 <unfixed> (embed)
647            - xulrunner <unfixed> (embed)
648            - libjifty-plugin-chart-perl <unfixed> (embed)
649            - sabnzbdplus <unfixed> (embed)
650            - tgmochikit <unfixed> (embed)
651    
652    prototypejs
653            - netbeans-ide 6.0.1+dfsg-2 (embed)
654            - auth2db 0.2.5-2+dfsg-1 (embed; bug #555218)
655            - webcit <unfixed> (embed; bug #555219)
656            - asterisk 1:1.6.2.0~rc3-1 (embed)
657            - libjson-ruby 1.1.4-1 (embed; bug #555224)
658            - lucene2 2.9.1+ds1-2 (embed; bug #555226)
659            - horde3 <unfixed> (embed)
660            - knowledgeroot <unfixed> (embed; bug #555230)
661            - mediatomb <unfixed> (embed; bug #555233)
662            - mt-daapd 0.9~r1696.dfsg-6lenny2 (embed)
663            - ebug-http <unfixed> (embed; bug #555236)
664            - phpgedview <removed> (embed)
665            - poker-network <unfixed> (embed; bug #555238)
666            - rails 2.1.0-6 (embed)
667            - wordpress 2.5.0-2 (embed; bug #555243)
668            - zope <not-affected> (the prototypejs embed is not in any of the obvious zope packages, e.g. zope2.9, zope2.10, zope2.11, and zope3)
669            TODO: search through all of the other zope packages
670            - ampache 3.4.1-2 (embed)
671            - exaile 0.2.14+debian-2.1 (embed; bug #555245)
672            - hobix 0.5~svn20070319-4 (embed; bug #555247)
673            - zabbix 1.6.6-4 (embed; bug #555250)
674            - chora2 <unfixed> (embed; bug #555253)
675            - gollem <unfixed> (embed; bug # 555254)
676            - jscropperui 1.2.1-1 (embed; bug #555257)
677            - scriptaculous <not-affected> (uses system prototype.js since initial upload; bug #555260)
678            - ingo1 <unfixed> (embed; bug #555261)
679            - kronolith2 <unfixed> (embed; bug #555262)
680            - activeldap <unfixed> (embed)
681            - libv8 <not-affected> (contains a google-specific implementation of prototype.js)
682            - mantis <unfixed> (embed; bug #555265)
683            - otrs2 2.3.4-6 (embed; bug #555267)
684            - webcalendar <unfixed> (embed; bug #555269)
685            - redmine 0.9.0~svn2907-1 (embed; bug #555270)
686            - jifty 0.90519-1 (embed; bug #555271)
687            - jquery <unfixed> (embed; bug #555272)
688            - passenger 2.2.5debian1-1 (embed; bug #555273)
689            - plone3 <unfixed> (embed; bug #555275)
690            - wesnoth <not-affected> (prototype.js not included in any of the binary packages; bug #555277)
691            - xulrunner <unfixed> (embed)
692            NOTE: included in iceweasel/xulrunner unit tests directory, so may not be security-relevant
693    
694  liblua:  gdb
695  monotone          - insight <unfixed> (embed)
696    
697  libbotan:  e2fsprogs
698  montone          - ldiskfsprogs <unfixable> (fork)
699    
700  NetXX:  quazip (not packaged in Debian)
701  monotone          - qcake <unfixed> (embed)
702            NOTE: starting with upstream version 0.6.4
703    
704    exo
705            - pcmanfm <unfixed> (embed; bug #499677)
706            NOTE: slightly modified source code
707    
708    java
709            - openjdk-6 <unfixed>
710            - sun-java5 <unfixed>
711            - sun-java6 <unfixed>
712    
713    libphp-snoopy
714            - ampache 3.4.1-2 (embed; bug #504169)
715            - mahara 1.0.5-2 (embed; bug #504170)
716            - pixelpost 1.7.1-5 (embed; bug #504171)
717            - mediamate 0.9.3.6-5 (embed; bug #504172)
718            - opendb <removed> (embed; bug #504173)
719            [etch] - opendb <unfixed> (embed; bug #504173)
720            - wordpress 2.5.1-9 (embed; bug #443948)
721            - moodle <unfixed> (embed; bug #507185)
722            [etch] - phpgroupware <unfixed> (embed)
723            NOTE: phpgroupware-felamimail
724            - magpierss 0.72-3 (embed; bug #431089)
725    
726    jquery
727            - zekr <unfixed> (embed)
728            - wordpress <unknown> (embed)
729            - yocto-reader <unfixed> (embed)
730            - textpattern <unfixed> (embed)
731            - genshi 0.5.1-1 (embed)
732            NOTE: compressed file under examples/ dir
733            - prewikka <unfixed> (embed)
734            - libramaze-ruby <unfixed> (embed)
735            - drupal5 <unfixed> (embed)
736            - b2evolution <unfixed> (embed)
737            - wesnoth <unfixed> (embed)
738    
739    tablesorter (jquery plugin, not packaged yet)
740            - wesnoth <unfixed> (embed)
741    
742    kses
743            - wordpress <unfixed> (embed; bug #504242)
744            NOTE: their copy has all methods renamed to wp_<foo>
745            NOTE: kses isn't in Debian, RFP: #504240
746            - moodle <unfixed> (embed; bug #507185)
747            - egroupware <unfixed> (embed)
748    
749  libgc:  magpierss
750  mono          - wordpress <unfixed> (embed; bug #504242)
751            - moodle <unfixed>
752    
753    php-gettext
754            - wordpress 2.8.4-1 (embed; bug #504242)
755    
756    libphp-ixr (name may change, it is the Incutio XML-RPC)
757            - wordpress <unfixed> (embed; bug #504242)
758            NOTE: libphp-ixr isn't in Debian, RFP: #504236
759            - dokuwiki <unfixed> (embed)
760            - textpattern <unfixed> (embed)
761    
762    libphp-cas
763            - glpi <unfixed> (embed)
764            - moodle <unfixed> (embed; bug #505984)
765    
766    scriptaculous (prototype.js is among the embeds in the following)
767            - glpi <unfixed> (embed)
768            - libaws <unfixed> (embed; bug #555222)
769            - op-panel <unfixed> (embed)
770            - symfony <unfixed> (embed)
771            NOTE: maintainer says there are extra incompatible changes required
772            - pixelpost 1.7.1-6 (embed)
773            - webhelpers <unfixed> (embed)
774            - qwik <unfixed> (embed; bug #555241)
775            - smokeping <unfixed> (embed)
776            - turba2 <unfixed> (embed)
777            - typo3-src 4.2.3-1 (embed)
778            - request-tracker3.6 <unfixed> (embed)
779            - request-tracker3.8 <unfixed> (embed)
780            - rt-extension-emailcompletion <not-affected> (prototype.js not included in the binary package)
781            - wordpress 2.5.0-2 (embed)
782    
783    libmarkdown-php
784            - moodle <unfixed> (embed; bug #507185)
785            - pixelpost 1.7.1-6 (embed)
786    
787    php-openid
788            - wordpress-openid <itp> (embed)
789    
790    geshi
791            - dokuwiki 0.0.20080505-3.1 (embed)
792            - pgfouine 1.0-1.1 (embed)
793            - websvn 2.1.0-1 (embed)
794    
795    webcalendar
796            - gforge 4.7~rc2-6 (embed; bug #504758)
797    
798    libical
799            - kdepim <unfixed> (fork)
800            - kdepimlibs <unfixed> (fork)
801            NOTE: fixed in KDE4 post 4.1.x series
802            - claws-mail-extra-plugins <unfixed> (fork)
803    
804    libltdl3
805            - kdelibs <unfixed> (embed)
806            NOTE: it's been said it sets RT_GLOBAL (or something like that) at runtime and version in experimental of libltdl can optionally set it
807            - synfig <unfixed> (embed)
808    
809    harfbuzz
810            - qt4-x11 <unfixed> (embed)
811    
812    libzip
813            - php5 <unfixed> (fork)
814            - odt2txt <unfixed> (embed; bug #523808)
815    
816    json.php (not packaged; should be replaced with php's built-in functions)
817            - moodle <unfixed>
818            - yui <unfixed>
819            - gallery2 <unfixed>
820            - dokuwiki <unfixed>
821            - typo3-src <unfixed>
822    
823    php-fpdf
824            - tcpdf <itp> (fork)
825            - moodle <unfixed>
826            - phpwiki <unfixed>
827            - egroupware <unfixed>
828            - ldap-account-manager <unfixed> (fork)
829    
830    tcpdf (itp: #495985)
831            - moodle <unfixed>
832            - phpmyadmin <unfixed>
833    
834  lzma:  typo3
835  p7zip          - moodle <unfixed>
836    
837  lzo:  spreadsheet_writeexcel (PHP port of libspreadsheet-writeexcel-perl; itp: #487557)
838  grub2          - moodle <unfixed>
839            - gosa <unfixed>
840    
841    php-ole (itp: #487558)
842            - moodle <unfixed>
843    
844    pieforms (http://www.catalyst.net.nz)
845            - mahara <unfixed>
846    
847    savant2 (http://phpsavant.com)
848            - egroupware <unfixed>
849    
850    rssparser (http://nwow.org)
851            - egroupware <unfixed>
852            - phpgroupware <unfixed>
853    
854    lcms
855            - openjdk-6 <unfixed> (fork)
856    
857    libphp-phplayersmenu
858            - diogenes <unfixed>
859            - phpldapadmin <unfixed>
860    
861    libphp-pclzip
862            - docvert <unfixed>
863            - moodle <unfixed>
864            - egroupware <unfixed>
865    
866    libphp-simplepie
867            - dokuwiki <unfixed>
868    
869    libphp-jpgraph
870            - egroupware <unfixed>
871    
872    php-simpletest
873            - moodle <unfixed>
874    
875    libpng
876            - iceweasel <not-affected> (uses xulrunner)
877            - icedove 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1, 2.0.0.19-1 (embed)
878            - iceape 1.0.13~pre080614i-0etch1 (embed)
879            - xulrunner 1.9.0.13-1 (embed)
880            [lenny] - xulrunner 1.9.0.11-0lenny1
881            [etch] - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
882            - gamera 3.2.3-1 (embed)
883    
884    irssi
885            - silc-client <unfixed> (embed)
886            NOTE: Seems to be a pre-0.8.12 version that is used in irssi-plugin-silc
887    
888    extc
889            - mtasc <unfixed> (embed)
890            - haxe <unfixed> (embed)
891    
892    swflib
893            - mtasc <unfixed> (embed)
894            - haxe <unfixed> (embed)
895    
896    libitext-java
897            - bouncycastle 2.1.4-1 (embed)
898    
899    python-ply
900            - pyke <unfixed> (embed; bug #555363)
901            - pywbem <unfixed> (embed; bug #555364)
902            - sepolgen <unfixed> (embed; bug #555365)
903            - zope-textindexng3 <unknown> (embed)
904            - iceweasel <unknown> (embed)
905            - xulrunner <unknown> (embed)
906            - wireshark <not-affected> (python-ply modules are not installed into binary packages; see #554613)
907    
908    libdumbnet (libdnet upstream)
909            - nmap <unfixed> (fork)
910    
911    gcc-4.4
912            - gcc-mingw32 <unfixed> (embed)
913    
914    camlimages
915            - advi <unfixed> (static; bug #550441)
916    
917    memcached
918            - memcachedb <unfixed> (embed)
919    
920    yajl
921            - argyll <unfixed> (embed; bug #544223)
922            NOTE: reference, confirmed by build logs: http://lists.debian.org/debian-mentors/2009/08/msg00062.html
923    
924    libept
925            - adept <unfixed> (embed; bug #540649)
926    
927    libvorbis
928            - iceweasel <not-affected> (uses xulrunner)
929            - xulrunner <unfixed> (embed; bug #540959)
930            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
931            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
932    
933    cairo
934            - iceweasel <not-affected> (uses xulrunner)
935            - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
936    
937    liboggz
938            - iceweasel <not-affected> (uses xulrunner)
939            - xulrunner <unfixed> (embed; bug #540949)
940            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
941            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
942    
943    
944    liboggplay
945            - iceweasel <not-affected> (uses xulrunner)
946            - xulrunner <unfixed> (embed; bug #540949)
947            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
948            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
949    
950    php-net-dnsbl
951            - serendipity <unfixed> (embed)
952    
953    php-onyx-rss
954            - serendipity <unfixed> (embed)
955    
956    php-text-wiki
957            - serendipity <unfixed> (embed)
958    
959    php-xml-rpc
960            - serendipity <unfixed> (embed)
961    
962    polarssl (does not have a shared library)
963            - pdkim <itp> (embed; bug #543150)
964            - xyssl <unfixed> (old-version)
965    
966    pidgin
967            - gaim <removed> (old-version)
968    
969    icu
970            - webkit 1.0.1-1 (embed; bug #547214)
971            - texlive-bin <unfixed> (fork)
972            NOTE: texlive upstream working with icu upstream to merge their changes
973    
974    cyrus-imapd-2.2
975            - kolab-cyrus-imapd <unfixed> (fork)
976            - dovecot 1:1.2.1-1 (embed) [/dovecot-sieve/src/libsieve/*]
977    
978    python-cxx-dev
979            - freecad <unfixed> (embed; bug #547936)
980    
981    libzipios++-dev
982            - freecad <unfixed> (embed; bug #547941)
983    
984    linux-2.6
985            - kvm <unfixed> (embed; bug #549973) [./kernel/*]
986            - linux-kbuild-2.6 <unfixed> (embed; bug #550379) [./kbuild/*]
987            - kernel-source-2.6.8 <removed> (old-version)
988            - kernel-source-2.4.27 <removed> (old-version)
989            - kernel-source-2.4.24 <removed> (old-version)
990            - kernel-source-2.2.25 <removed> (old-version)
991            - kernel-source-2.2.20 <removed> (old-version)
992    
993    libfdt (not yet packaged separately for debian; http://www.jdl.com/software/)
994            - kvm <unfixed> (embed) [./libfdt/*]
995    
996    qweb (not packaged)
997            - ajaxterm <unfixed>
998    
999    opensaml2
1000            - opensaml <removed> (old-version)
1001    
1002    shibboleth-sp2
1003            - shibboleth-sp <removed> (old-version)
1004    
1005    tuxonice-userui
1006            - suspend2-userui <removed> (old-version)
1007    
1008    expat
1009            - w3c-libwww <removed> (embed; bug #551941)
1010            [etch] - w3c-libwww <unfixed> (embed; bug #551941) [./modules/expat/*]
1011            - python-xml <unfixed> (embed; bug #551940) [./extensions/expat/*]
1012            - python2.5 <unfixed> (embed; bug #553403) [./Modules/expat/*]
1013            - python2.4 <unfixed> (embed; bug #553403)
1014            - wxwindows2.4 <removed> (embed)
1015            - wxwidgets2.6 <unfixed> (embed)
1016            - wxwidgets2.8 <unfixed> (embed)
1017            - celementtree <unfixed> (embed)
1018            - audacity <unfixed> (embed)
1019            - matanza <unfixed> (embed)
1020            - tdom <unfixed> (embed)
1021            - udunits <unfixed> (embed)
1022            - apr-util 1.2 (embed)
1023            - ayttm <unfixed> (embed)
1024            - cableswig <unfixed> (embed)
1025            - cadaver <unfixed> (embed)
1026            - cmake <unfixed> (embed)
1027            - coin3 <unfixed> (embed)
1028            - gdcm <unfixed> (embed)
1029            - ghostscript <unfixed> (embed)
1030            - grmonitor <unfixed> (embed)
1031            - iceape <unfixed> (embed)
1032            - insighttoolkit <unfixed> (embed)
1033            - libparagui1.1 <unfixed> (embed)
1034            - paraview <unfixed> (embed)
1035            - poco <unfixed> (embed)
1036            - simgear <unfixed> (embed)
1037            - sitecopy <unfixed> (embed)
1038            - smart 1.0-1 (embed)
1039            [etch] - smart <unfixed> (embed)
1040            - swish-e <unfixed> (embed)
1041            - tla <unfixed> (embed)
1042            - vtk <unfixed> (embed)
1043            - wbxml2 <unfixed> (embed)
1044            - xmlrpc-c <unfixed> (embed)
1045            - iceweasel <unfixed> (embed)
1046            - kompozer <unfixed> (embed)
1047            - vxl <unfixed> (embed)
1048            - xulrunner <unfixed> (embed)
1049            - apache2 2.2 (embed)
1050            - texlive-bin <unfixed> (embed) [included twice]
1051            - vnc4 <unfixed> (embed)
1052            - xotcl <unfixed> (embed)
1053    
1054    xerces-c
1055            - xerces-c2 <unfixed> (old-version)
1056            - xerces27 <removed> (old-version)
1057    
1058    md5 (RSA's version; not the gnu version provided by coreutils)
1059            - w3c-libwww <removed> (embed; bug #551942)
1060            [etch] - w3c-libwww <unfixed> (embed; bug #551942) [./modules/md5/*]
1061    
1062    enet
1063            - sauerbraten <unfixed> (embed; #497194)
1064    
1065    eglibc
1066            - glibc <removed> (old-version)
1067    
1068    galib
1069            - gamera 3.2.3-1 (embed)
1070    
1071    configobj
1072            - bzr <unfixed> (embed; bug #555336)
1073            - elisa <unfixed> (embed; bug #555337)
1074            - gaupol <unfixed> (embed; bug #555338)
1075            - ipython <unfixed> (embed; bug #555339)
1076            - pida <unfixed> (embed; bug #555340)
1077            - psychopy <unfixed> (embed; bug #555341)
1078            - rest2web <unfixed> (embed; bug #555342)
1079            - auth2db <unknown> (embed)
1080            - dynagen <unknown> (embed)
1081            - iceweasel <unknown> (embed)
1082            - sabnzbdplus <unknown> (embed)
1083            - xulrunner <unknown> (embed)
1084            - nipy <not-affected> (part of an example [/examples/neurospin/neurospy/configobj.py], which is not installed into binary packages)
1085    
1086    python-clientform
1087            - bibus <unfixed> (embed; bug #555332)
1088            - zope2.10 <unfixed> (embed; bug #555333)
1089            - zope2.11 <unfixed> (embed; bug #555334)
1090            - python-mechanize <unknown> (embed)
1091            - twill <unknown> (embed)
1092    
1093    python-mechanize
1094            - zope2.10 <unfixed> (embed; bug #555337)
1095            - zope2.11 <unfixed> (embed; bug #555338)
1096            - twill <unknown> (embed; bug #555339)
1097    
1098    pexpect
1099            - duplicity 0.6.06-1 (embed; bug #555361)
1100            - hplip <unfixed> (embed; bug #555362)
1101            - smart <unfixed> (embed; bug #555363)
1102    
1103    pyparsing
1104            - bauble <unfixed> (embed; bug #555366)
1105            - boa-constructor 0.6.1-8 (embed; bug #555367)
1106            - calibre <unfixed> (embed; bug #555368)
1107            - matplotlib <unfixed> (embed; bug #531024)
1108            - zhpy <unfixed> (embed; bug #555370)
1109            - polybori <unknown> (embed)
1110            - python-whoosh <unknown> (embed)
1111            - twill <unknown> (embed)
1112            - zope-textindexng3 <unknown> (embed)
1113    
1114    python-pysqlite2
1115            - python2.4 <unfixed> (embed; bug #553403)
1116            - python2.5 <unfixed> (embed; bug #553403)
1117    
1118    celementtree
1119            - python2.5 <unfixed> (embed)
1120            - smart 1.0-1 (embed)
1121            [etch] - smart <unfixed> (embed)
1122    
1123    elementtree
1124            - python2.5 <unfixed> (embed)
1125            - bzr <unfixed> (embed; bug #555343)
1126            - gedit 2.28.2-1 (embed; bug #555344)
1127            - smart 1.0-1 (embed)
1128            [etch] - smart <unfixed> (embed)
1129            - solfege <unfixed> (embed; bug #555345)
1130            - w3af <unfixed> (embed; bug #555346)
1131            - python-qt4 <unknown> (embed)
1132            - sphinx <unknown> (embed)
1133            - python-nltk <itp> (embed)
1134    
1135    python2.5
1136            - python2.4 <unfixed> (old-version)
1137            - jython <unfixed> (embed)
1138            NOTE: embeds many stdlib modules
1139            - python-django <unfixed> (embed; bug #555419)
1140            NOTE: embeds stdlib modules: doctest, decimal
1141            - gamera 3.2.3-1 (embed)
1142            NOTE: embeds stdlib modules: ConfigParser, optparse, sets, textwrap
1143            - boa-constructor <unfixed> (embed; bug #555426)
1144            NOTE: embeds stdlib modules: ConfigParser, tarfile, zipfile, xmlrpclib
1145            - nicotine <unfixed> (embed; bug #555427)
1146            NOTE: embeds stdlib modules: ConfigParser
1147            - museek+ <unfixed> (embed; bug #555428)
1148            NOTE: embeds stdlib modules: ConfigParser
1149            - vegastrike-data <unfixed> (embed)
1150            NOTE: embeds many stdlib modules
1151            - codespeak-lib <unfixed> (embed; bug #555420)
1152            NOTE: embeds stdlib modules: doctest, optparse, subprocess, textwrap
1153            - config-manager <unfixed> (embed; bug #555423)
1154            NOTE: embeds stdlib modules: optparse
1155            - jhbuild 2.28.0-1 (embed; bug #555421)
1156            NOTE: embeds stdlib modules: optparse, subprocess
1157            - smart <unfixed> (embed; bug #555432)
1158            NOTE: embeds stdlib modules: optparse
1159            - pyprotocols <unfixed> (embed; bug #555433)
1160            NOTE: embeds stdlib modules: doctest
1161            - ruledispatch <unfixed> (embed; bug #555434)
1162            NOTE: embeds stdlib modules: doctest
1163            - distribute <unfixed> (embed)
1164            NOTE: embeds stdlib modules: doctest
1165            - python-setuptools <unfixed> (embed; bug #555435)
1166            NOTE: embeds stdlib modules: doctest
1167            - zope.testing <unfixed> (embed; bug #555436)
1168            NOTE: embeds stdlib modules: doctest
1169            - translate-toolkit <unfixed> (embed; bug #555422)
1170            NOTE: embeds stdlib modules: textwrap, contextlib
1171            - libtpclient-py <unfixed> (embed; bug #555424)
1172            NOTE: embeds stdlib modules: subprocess
1173            - grass <unfixed> (embed; bug #555425)
1174            NOTE: embeds stdlib modules: subprocess
1175            - coherence <unfixed> (embed; bug #555429)
1176            NOTE: embeds stdlib modules: uuid
1177            - python-django-extensions 0.4.2pre+git200911182050-1 (embed; bug #555430)
1178            NOTE: embeds stdlib modules: uuid
1179            - setroubleshoot <unfixed> (embed; bug #555431)
1180            NOTE: embeds stdlib modules: uuid
1181            - linkchecker <unfixed> (embed; bug #555414)
1182            NOTE: embeds msgfmt.py script
1183            - imdbpy <unfixed> (embed)
1184            NOTE: embeds msgfmt.py script
1185            - kiwi <unfixed> (embed)
1186            NOTE: embeds msgfmt.py script
1187            - moin <unfixed> (embed)
1188            NOTE: embeds msgfmt.py script, stdlib modules: cgitb, difflib, tarfile
1189            - plone3 <unfixed> (embed)
1190            NOTE: embeds msgfmt.py script
1191            - roundup <unfixed> (embed)
1192            NOTE: embeds msgfmt.py script, stdlib modules: cgitb
1193            - rednotebook <unfixed> (embed; bug #555415)
1194            NOTE: embeds msgfmt.py script
1195            - turbogears <unfixed> (embed)
1196            NOTE: embeds msgfmt.py script
1197            - elisa <unfixed> (embed)
1198            NOTE: embeds msgfmt.py script, stdlib modules: uuid
1199            - calibre <unfixed> (embed)
1200            NOTE: embeds msgfmt.py script, stdlib modules: zipfile
1201            - mailman <unfixed> (embed; #555416)
1202            NOTE: embeds msgfmt.py script
1203            - python-docutils <unknown> (embed)
1204            NOTE: embeds stdlib modules: optparse, textwrap
1205            - python-imaging <unknown> (embed)
1206            NOTE: embeds stdlib modules: doctest
1207            - python-mechanize <unknown> (embed)
1208            NOTE: embeds stdlib modules: doctest
1209            - twill <unknown> (embed)
1210            NOTE: embeds stdlib modules: subprocess
1211            - zeroc-ice <unknown> (embed)
1212            NOTE: embeds stdlib modules: subprocess
1213            - wxwidgets2.8 <unknown> (embed)
1214            NOTE: embeds stdlib modules: subprocess
1215            - cycle <unknown> (embed)
1216            NOTE: embeds msgfmt.py script
1217            - deluge <unknown> (embed)
1218            NOTE: embeds msgfmt.py script
1219            - opendict <unknown> (embed)
1220            NOTE: embeds msgfmt.py script
1221            - openerp-client <unknown> (embed)
1222            NOTE: embeds msgfmt.py script
1223            - rapidsvn <unknown> (embed)
1224            NOTE: embeds msgfmt.py script
1225            - wammu <unknown> (embed)
1226            NOTE: embeds msgfmt.py script
1227            - gaphor <unknown> (embed)
1228            NOTE: embeds msgfmt.py script
1229            - pida <unknown> (embed)
1230            NOTE: embeds msgfmt.py script
1231            - python-formencode <unknown> (embed)
1232            NOTE: embeds msgfmt.py script
1233            - duplicity <unfixed> (embed)
1234            NOTE: embeds stdlib module: urlparse, tarfile
1235            - pygopherd <unfixed> (embed)
1236            NOTE: embeds stdlib module: zipfile
1237    
1238    argparse
1239            - twill <unfixed> (embed; bug #555347)
1240            - ipython <unfixed> (embed; bug #555348)
1241    
1242    coherence
1243            - elisa <unfixed> (embed; bug #555335)
1244    
1245    simpletal
1246            - plastex <unfixed> (embed; bug #555371)
1247    
1248    flickrpc (not packaged in Debian, http://burtonini.com/bzr/flickrpc/)
1249            - postr <unfixed> (embed)
1250            - elisa <unfixed> (embed)
1251    
1252    simplegeneric (not packaged in Debian, http://pypi.python.org/pypi/simplegeneric)
1253            - apertium-tolk <unfixed> (embed)
1254            - ipython <unfixed> (embed)
1255            - virtaal <unfixed> (embed)
1256    
1257    distribute
1258            - setuptools <removed> (old-version)
1259    
1260    rails
1261            - jruby1.2 <unfixed> (embed) [./bench/rails/*]
1262            - libgettext-ruby <unfixed> (embed) [./samples/rails/*]
1263            - libopenid-ruby <unfixed> (embed) [./examples/rails_openid/*]
1264            - thin <unfixed> (embed) [./spec/rails_app/*]
1265            NOTE: this is a subdirectory of examples, which in general is a non-issue, but may
1266            NOTE: be dangerous if developers are naively basing their code off of the examples
1267            NOTE: prototype.js is among the example files
1268    
1269    lucene2 (prototype.js is among the embeds in the following)
1270            - lucene <unfixed> (old-version)
1271            - pylucene <unfixed> (embed)
1272            - libpdfbox-java <unfixed> (embed)
1273            - libfontbox-java <unfixed> (embed)
1274            - libjempbox-java <unfixed> (embed)
1275            - solr <unfixed> (embed)
1276    
1277    unicode-data
1278            - syslinux <unfixed> (embed)
1279            - camomile <unfixed> (embed)
1280            - fribidi <unfixed> (embed)
1281            - m17n-db <unfixed> (embed)
1282            - sbcl <unfixed> (embed)
1283            - heimdal <unfixed> (embed)
1284            - icu <unfixed> (embed)
1285            - icu4j <unfixed> (embed)
1286            - krb5 <unfixed> (embed)
1287            - moodle <unfixed> (embed)
1288            - openldap <unfixed> (embed)
1289            - pike7.6 <unfixed> (embed)
1290            - samba <unfixed> (embed)
1291            - samba4 <unfixed> (embed)
1292            - cmucl <unfixed> (embed)
1293            - typo3-src <unfixed> (embed)
1294            - mauve <unfixed> (embed)
1295            - texlive-bin <unfixed> (embed)
1296            - ypsilon <unfixed> (embed)
1297            - jeuclid <unfixed> (embed)
1298            - charmap.app <unfixed> (embed)
1299            - clisp <unfixed> (embed)
1300            - gnulib <unfixed> (embed)
1301            - opensrs-client <unfixed> (embed)
1302            - saxonb <unfixed> (embed)
1303            - rails <unfixed> (embed)
1304    
1305    feedparser
1306            - rawdog <unfixed> (embed; bug #383422)
1307            - miro <unfixed> (embed; bug #555351)
1308            - calibre <unfixed> (embed; bug #555352)
1309            - freevo <unfixed> (embed; bug #555353)
1310            - pida <unfixed> (embed; bug #555354)
1311            - planet-venus <unfixed> (embed; bug #555355)
1312            - plone3 <unfixed> (embed; bug #555356)
1313            - exaile 0.2.14+debian-1 (embed)
1314            - screenlets 0.1.2-3 (embed)
1315            NOTE: included twice
1316    
1317    agg:
1318            - matplotlib <unfixed> (embed: bug #377271)
1319            - contextfree <unfixed> (embed)
1320            NOTE: since 2.2-1 it links statically to system libagg, but still uses the embedded copy
1321            - exactimage <unfixed> (embed)
1322            - python-enable <unfixed> (embed)
1323            - mapnik 0.5.1-3 (embed)
1324            NOTE: links statically to agg, but shared library is not available (bug #377271)
1325    
1326    vtk
1327            - paraview <unfixable> (embed; bug #495426)
1328    
1329    txt2tags
1330            - rednotebook <unfixed> (embed)
1331    
1332    htmltextview (not packaged in Debian, http://www.gnome.org/~gjc/htmltextview.py)
1333            - gajim <unfixed> (embed)
1334            - emesene <unfixed> (embed)
1335            - convirt <unfixed> (embed)
1336            - pida <unfixed> (embed)
1337            - rednotebook <unfixed> (embed)
1338    
1339    horde3 (prototype.js is among the embeds in the following)
1340            - mnemo2 <unfixed> (embed)
1341            - nag2 <unfixed> (embed)
1342    
1343  pax code:  cimg
1344  tar          - gmic <itp> (embed)
1345  cpio  
1346    mootools
1347            - gmic <itp> (embed)
1348    
1349    openldap
1350            - openldap2.3 <removed> (old-version)
1351    
1352    grub2
1353            - grub <unfixed> (old-version)
1354    
1355  t1lib:  gnupginterface
1356  tetex-bin (links to system t1lib since 2.0.2)          - duplicity <unfixed> (embed)
 texlive-bin (links to system t1lib)  
1357    
1358    python-dateutil
1359            - awn-extras-applets <unfixed> (embed)
1360            - matplotlib <unknown> (embed)
1361    
1362    cups
1363            - cupsys <removed> (old-version)
1364    
1365    yui
1366            - bcfg2 <not-affected> (present in source but not included in any binary files)
1367            - serendipity <unfixed> (embed; bug #557746)
1368            - moodle 1.8.2.dfsg-5 (embed)
1369            - jifty <unfixed> (embed; bug #557748)
1370            - webgui 7.7.26-1 (embed)
1371            - loggerhead 1.17-1 (embed)

Legend:
Removed from v.7830  
changed lines
  Added in v.13396

  ViewVC Help
Powered by ViewVC 1.1.5