/[secure-testing]/data/embedded-code-copies

Diff of /data/embedded-code-copies

Parent Directory | Revision Log | View Patch Patch

-revision 13435 by pabs,
Thu Dec  3 09:40:23 2009 UTC
+revision 13612 by jmm-guest,
Sun Dec 20 10:11:18 2009 UTC
 Line 15 
 status: version number fixing the embedd
          be determined, or <unfixable> for unavoidable cases (e.g., forks
          that add real value)
  sort: static (linking statically against a lib)
-       embed (embedding a copy of the library into another source package)
+       embed (embeds a copy of the library into another source package)
-       fork (the package is not just embedding code but it is a fork and
+       modified-embed (embeds a code copy that differs from upstream code)
-             thus might share parts of the source code)
+       fork (a full-blown fork of another source package)
-       old-version (the package is an older version of essentially
+       old-version (an older version of essentially the same code)
-                    the same code)
  The srcpkg might be some string to identify the code if there is no
  specific source package.
-Line 56 
 libevent
+Line 55 
 libevent
  lrmi
          - read-edid 2.0.0-1 (embed; bug #495131)
+         - s3switch <unfixed> (embed)
+         - xresprobe <unfixed> (embed)
+         - zhcon <unfixed> (embed)
  peercast
          - gnome-peercast <removed> (embed)
-Line 82 
 spandsp
+Line 84 
 spandsp
          - iaxmodem <unfixable> (embed; bug #548885)
  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
-         - dpkg <unfixed> (embed)
+         - dpkg <unfixed> (static)
          NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
          - rsync <unfixed> (embed)
          NOTE: somehow derived code base
-Line 138 
 libbz2
+Line 140 
 libbz2
          - dpkg <unfixed> (static)
  libgadu
-         - centericq <unfixed> (embed)
+         - centerim <unfixed> (embed; bug #559783)
          - pidgin <not-affected> (links dynamically since initial release; fixed in gaim)
          - gaim 1:2.0.0+beta3-3 (embed; bug #360280)
          - kdenetwork 4:3.3.2-5 (embed)
-Line 159 
 shtool (affects build-time only)
+Line 161 
 shtool (affects build-time only)
          - mysql-ocaml <unfixed> (embed)
          - php4 <unfixed> (embed)
- iceape
+ xulrunner
-         - iceweasel <unfixed> (fork)
+         - iceape <unfixed> (embed; bug #561749)
-         - icedove <unfixed> (fork)
+         - iceweasel 2.0.0.19 (embed)
-         - xulrunner <unfixed> (fork)
+         - icedove <unfixed> (embed; bug #561750)
          - kompozer <unfixed> (embed; bug #532168)
-         - galeon <unfixed> (fork)
+         - galeon 2.0.2-4 (embed)
-         - epiphany-browser <unfixed> (fork)
+         - epiphany-browser 2.14.3-8 (embed)
-         - conkeror <unfixed> (fork)
+         - conkeror 0.9~git080629-2 (embed)
-         - kazehakase <unfixed> (fork)
+         - kazehakase 0.4.2-1 (embed)
  xli
          - xloadimage <unfixed> (embed)
-Line 197 
 libbsd
+Line 199 
 libbsd
          - atheme-services <unfixed>
          - libbsd-arc4random-perl <unfixed>
          - isakmpd <unfixed>
+         - bsdgames <unfixed> (embed)
+         - bsd-mailx <unfixed> (embed)
+         - netcat-openbsd <unfixed> (embed; bug #550611)
+         - openssh <unfixed> (embed)
+         - unworkable <unfixed> (embed)
  cvs
          - gcvs <unfixed> (embed)
-Line 236 
 sqlite (not affected by security vulnera
+Line 243 
 sqlite (not affected by security vulnera
          - amarok <unfixed> (embed)
          - monotone 0.43-1 (embed)
          - iceweasel <unfixed> (embed)
+         - heimdal <unfixed> (embed; bug #559616)
  util-linux/mount
          - loop-aes-utils <unfixed> (embed)
-Line 266 
 ffmpeg (libavcodec/libavformat)
+Line 274 
 ffmpeg (libavcodec/libavformat)
          - xmovie <removed> (static)
          TODO: gimp-gap (potentially using ffmpeg code as well)
          - avifile 1:0.7.48~20090503.ds-1 (embed; bug #538750)
+         - audacity 1.3.7-2 (embed; bug #512278)
  faad2
          - mplayer 1.0~rc2-20 (embed)
-Line 414 
 neon
+Line 423 
 neon
          [etch] - litmus <unfixed> (embed; #395875)
          - litmus <removed> (embed; #395875)
          [sarge] - screem <unfixed> (embed)
-         - sitecopy 1:0.16.3-5 (embed; bug #395876)
+         - sitecopy 1:0.16.0-1 (embed; bug #395876)
          [etch] - tla <unfixed> (embed; bug #395877)
          [sarge] - tla <unfixed> (embed; bug #395877)
-Line 427 
 libvncserver
+Line 436 
 libvncserver
  putty
          - filezilla <unfixed> (embed)
- tinyxml (not packaged in Debian)
+ tinyxml (not packaged in Debian; itp bug #531968)
          - filezilla <unfixed>
+         - crystalspace <unfixed> (embed)
+         - libwfut <unfixed> (embed)
+         - rarian <unfixed> (embed)
+         - bulletml <unfixed> (embed)
+         - pokerth <unfixed> (embed)
+         - qutecom <unfixed> (embed)
+         - sofa-framework <unfixed> (embed)
+         - yate <unfixed> (embed)
+         - antigrav <unfixed> (embed)
+         - balder2d <unfixed> (embed)
+         - cal3d <unfixed> (embed)
+         - criticalmass <unfixed> (embed)
+         - ember <unfixed> (embed)
+         - epiphany <unfixed> (embed)
+         - gambit <unfixed> (embed)
+         - noiz2sa <unfixed> (embed)
+         - ogre <unfixed> (embed)
+         - opencity <unfixed> (embed)
+         - openmovieeditor <unfixed> (embed)
+         - pouetchess <unfixed> (embed)
+         - tecnoballz <unfixed> (embed)
+         - trigger-rally <unfixed> (embed)
+         - xmoto <unfixed> (embed)
+         - mapnik <unknown> (embed)
+         NOTE: uses a different XML parser by default
+         - rrootage 0.23a-6 <embed>
+         NOTE: links to libbulltetml
+         - boson <unknown> (embed)
+         NOTE: the embedded code is unused
  gv
          - evince <unfixed> (embed)
-Line 482 
 librpcsecgss
+Line 520 
 librpcsecgss
          - krb5 <unfixed> (embed)
  jasper
-         - ghostscript <unfixed> (embed)
+         - ghostscript 8.64~dfsg-2 (embed)
-         - gs-gpl <unfixed> (embed)
  libiris
          - psi <unfixed> (embed)
-Line 504 
 liblua
+Line 541 
 liblua
          - nmap 5.00-1 (embed; bug #527997)
          [lenny] - nmap <unfixed> (embed; bug #527997)
          - ocropus <unfixed> (embed)
+         - enigma <unfixed> (embed)
+         NOTE: requires lua built with C++
+         - freeciv <unfixed> (embed)
  libbotan
          - monotone 0.43-1 (embed)
-Line 539 
 guichan
+Line 579 
 guichan
  tolua
          - boswars <unfixed> (embed)
          NOTE: maintainer notified us, working on it
+         NOTE: actually tolua++
          - ocropus <unfixed> (embed)
+         NOTE: actually tolua++
          - freeciv <unfixed> (embed)
+         NOTE: actually tolua++
+         - enigma <unfixed> (embed)
  asio-dev
          - luxrender <removed> (embed)
-Line 596 
 cpio
+Line 640 
 cpio
          NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
  webkit
-         - qt4-x11 <unfixed> (embed)
+         - qt4-x11 <unfixed> (embed; bug #479851)
+         - kdelibs <unfixed> (old-version)
+         - kde4libs <unfixed> (fork)
  ftgl
          - blender 2.46+dfsg-1 (embed)
-Line 606 
 wv
+Line 652 
 wv
  qemu
          - kvm <unfixed> (embed; bug #543159)
-         - xen-3 <unfixed> (embed)
+         NOTE: the kvm package will be removed from sid and squeeze soon (after
-         - xen-unstable <unfixed> (embed)
+         NOTE: which it will only be in experimental). superceded by qemu-kvm.
+         - qemu-kvm <unfixed> (embed; bug #560853)
+         - xen-3 3.4.2-2 (embed; bug #560856)
+         - xen-unstable <unfixed> (embed; bug #560856)
  vgabios
          - kvm <unfixed> (embed; bug #489442)
-Line 621 
 speex
+Line 670 
 speex
          - gst-plugins-good0.10 <unfixed> (embed)
          - xine-lib <unfixed> (embed)
          - libfishsound <unfixed> (embed)
-         - libannodex <unfixed> (embed)
+         - libannodex <removed> (embed)
          - vlc <unfixed> (embed)
          - xmms-speex <unfixed> (embed)
          - libsdl-sound1.2 <unfixed> (embed)
-Line 665 
 prototypejs
+Line 714 
 prototypejs
          - mediatomb <unfixed> (embed; bug #555233)
          - mt-daapd 0.9~r1696.dfsg-6lenny2 (embed)
          - ebug-http <unfixed> (embed; bug #555236)
+         - libaws 2.7-1 (embed; bug #555222)
          - phpgedview <removed> (embed)
          - poker-network <unfixed> (embed; bug #555238)
          - rails 2.1.0-6 (embed)
-Line 692 
 prototypejs
+Line 742 
 prototypejs
          - passenger 2.2.5debian1-1 (embed; bug #555273)
          - plone3 <unfixed> (embed; bug #555275)
          - wesnoth <not-affected> (prototype.js not included in any of the binary packages; bug #555277)
-         - libhtml-prototype-perl <unfixed> (embed; bug #538920)
+         - libhtml-prototype-perl 1.48-3 (embed; bug #538920)
          - xulrunner <unfixed> (embed)
          NOTE: included in iceweasel/xulrunner unit tests directory, so may not be security-relevant
-Line 777 
 scriptaculous (prototype.js is among the
+Line 827 
 scriptaculous (prototype.js is among the
          NOTE: maintainer says there are extra incompatible changes required
          - pixelpost 1.7.1-6 (embed)
          - webhelpers <unfixed> (embed)
-         - qwik <unfixed> (embed; bug #555241)
+         - qwik <removed> (embed; bug #555241)
          - smokeping <unfixed> (embed)
          - turba2 <unfixed> (embed)
          - typo3-src 4.2.3-1 (embed)
-Line 785 
 scriptaculous (prototype.js is among the
+Line 835 
 scriptaculous (prototype.js is among the
          - request-tracker3.8 <unfixed> (embed)
          - rt-extension-emailcompletion <not-affected> (prototype.js not included in the binary package)
          - wordpress 2.5.0-2 (embed)
+         - libhtml-prototype-perl 1.48-3 (embed)
  libmarkdown-php
          - moodle <unfixed> (embed; bug #507185)
-Line 816 
 harfbuzz
+Line 867 
 harfbuzz
          - qt4-x11 <unfixed> (embed)
  libzip
-         - php5 <unfixed> (fork)
+         - php5 <unfixable> (modified-embed)
          - odt2txt <unfixed> (embed; bug #523808)
  json.php (not packaged; should be replaced with php's built-in functions)
-Line 948 
 cairo
+Line 999 
 cairo
  liboggz
          - iceweasel <not-affected> (uses xulrunner)
-         - xulrunner <unfixed> (embed)
+         - xulrunner <unfixed> (embed; bug #540959)
          [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
          [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
          - iceape <unfixed> (embed)
-Line 957 
 liboggz
+Line 1008 
 liboggz
  liboggplay
          - iceweasel <not-affected> (uses xulrunner)
-         - xulrunner <unfixed> (embed)
+         - xulrunner <unfixed> (embed; bug #540959)
          [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
          [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
          - iceape <unfixed> (embed)
-Line 982 
 polarssl (does not have a shared library
+Line 1033 
 polarssl (does not have a shared library
  pidgin
          - gaim <removed> (old-version)
+         - qutecom <unfixed> (embed; bug #559785)
  icu
          - webkit 1.0.1-1 (embed; bug #547214)
-Line 993 
 cyrus-imapd-2.2
+Line 1045 
 cyrus-imapd-2.2
          - dovecot 1:1.2.1-1 (embed) [/dovecot-sieve/src/libsieve/*]
  python-cxx-dev
-         - freecad <unfixed> (embed; bug #547936)
+         - freecad 0.9.2646.3-1 (embed; bug #547936)
- libzipios++-dev
+ zipios++
-         - freecad <unfixed> (embed; bug #547941)
+         - freecad 0.9.2646.3-1 (embed; bug #547941)
+         - enigma 0.92.3-3 (embed)
+         NOTE: likely fixed earlier, marking etch's version as fixed
  linux-2.6
          - kvm <unfixed> (embed; bug #549973) [./kernel/*]
-Line 1026 
 expat
+Line 1080 
 expat
          - w3c-libwww <removed> (embed; bug #551941)
          [etch] - w3c-libwww <unfixed> (embed; bug #551941) [./modules/expat/*]
          - python-xml <unfixed> (embed; bug #551940) [./extensions/expat/*]
-         - python2.5 <unfixed> (embed; bug #553403) [./Modules/expat/*]
+         - python2.5 <unfixable> (embed; bug #553403) [./Modules/expat/*]
-         - python2.4 <unfixed> (embed; bug #553403)
+         - python2.4 <unfixable> (embed; bug #553403)
+         - python-4suite <unfixed> (embed; bug #516935)
          - wxwindows2.4 <removed> (embed)
-         - wxwidgets2.6 <unfixed> (embed)
+         - wxwidgets2.6 2.6.3.2.2-4 (embed)
-         - wxwidgets2.8 <unfixed> (embed)
+         - wxwidgets2.8 2.8.10.1-2 (embed)
-         - celementtree <unfixed> (embed)
+         - celementtree 1.0.5-8 (embed)
-         - audacity <unfixed> (embed)
+         NOTE: Maybe that was fixed even earlier
+         - audacity 1.3.2-1 (embed)
          - matanza <unfixed> (embed)
          - tdom <unfixed> (embed)
-         - udunits <unfixed> (embed)
+         - udunits 2.1.8-4 (embed)
          - apr-util 1.2 (embed)
-         - ayttm <unfixed> (embed)
+         - ayttm <unfxed> (embed; bug #561006)
          - cableswig <unfixed> (embed)
          - cadaver <unfixed> (embed)
-         - cmake <unfixed> (embed)
+         - cmake 2.6.0-6 (embed)
          - coin3 <unfixed> (embed)
-         - gdcm <unfixed> (embed)
+         - gdcm 2.0.14-2 (embed)
          - ghostscript <unfixed> (embed)
          - grmonitor <unfixed> (embed)
          - iceape <unfixed> (embed)
-         - insighttoolkit <unfixed> (embed)
+         - insighttoolkit 3.16.0-1 (embed)
+         NOTE: insighttoolkit might've been fixed earlier
          - libparagui1.1 <unfixed> (embed)
          - paraview <unfixed> (embed)
          - poco <unfixed> (embed)
          - simgear <unfixed> (embed)
-         - sitecopy <unfixed> (embed)
+         - sitecopy 1:0.16.0-1
          - smart 1.0-1 (embed)
-         [etch] - smart <unfixed> (embed)
          - swish-e <unfixed> (embed)
          - tla <unfixed> (embed)
-         - vtk <unfixed> (embed)
+         - vtk 4.1.20030227-1 (embed)
          - wbxml2 <unfixed> (embed)
          - xmlrpc-c <unfixed> (embed)
          - iceweasel <unfixed> (embed)
          - kompozer <unfixed> (embed)
-         - vxl <unfixed> (embed)
+         - vxl 1.13.0-2 (embed)
          - xulrunner <unfixed> (embed)
          - apache2 2.2 (embed)
-         - texlive-bin <unfixed> (embed) [included twice]
+         - texlive-bin <not-affected> (Embedded code not compiled in)
          - vnc4 <unfixed> (embed)
          - xotcl <unfixed> (embed)
-Line 1383 
 yui
+Line 1439 
 yui
          - bcfg2 <not-affected> (present in source but not included in any binary files)
          - serendipity <unfixed> (embed; bug #557746)
          - moodle 1.8.2.dfsg-5 (embed)
-         - jifty <unfixed> (embed; bug #557748)
+         - jifty 0.91117-1 (embed; bug #557748)
          - webgui 7.7.26-1 (embed)
          - loggerhead 1.17-1 (embed)
-Line 1396 
 quake2 (vanilla source not packaged in d
+Line 1452 
 quake2 (vanilla source not packaged in d
  libtheora
          - iceweasel <not-affected> (uses xulrunner)
-         - xulrunner <unfixed> (embed)
+         - xulrunner <unfixed> (embed; bug #540959)
          [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
          [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
          - iceape <unfixed> (embed; bug #559276)
          [etch] - iceape <not-affected> (introduced in iceape 2.0)
          [lenny] - iceape <not-affected> (introduced in iceape 2.0)
+ dtoa
+         - bfilter <unfixed> (embed)
+         - cacao <unfixed> (embed)
+         - cdrdao <unfixed> (embed)
+         - classpath <unfixed> (embed)
+         - freej <unfixed> (embed)
+         - iceape <unfixed> (embed)
+         - iceweasel <unfixed> (embed)
+         - jscoverage <unfixed> (embed)
+         - kde4libs <unfixed> (embed)
+         - kdelibs <unfixed> (embed)
+         - kompozer <unfixed> (embed)
+         - libv8 <unfixed> (embed)
+         - mono <unfixed> (embed)
+         - newlib <unfixed> (embed)
+         - nspr <unfixed> (embed)
+         - php5 <unfixed> (embed)
+         - polyml <unfixed> (embed)
+         - qt4-x11 <unfixed> (embed)
+         - rhino <unfixed> (embed)
+         NOTE: code translated to Java
+         - ruby1.8 <unfixed> (embed)
+         - ruby1.9 <unfixed> (embed)
+         - ruby1.9.1 <unfixed> (embed)
+         - sdd <unfixed> (embed)
+         - sfind <unfixed> (embed)
+         - star <unfixed> (embed)
+         - tinymux <unfixed> (embed)
+         - virtualbox-ose <unfixed> (embed)
+         - webkit <unfixed> (embed)
+         - xulrunner <unfixed> (embed)
+ ipc (not packaged in Debian; see http://mozdev.org/pipermail/enigmail/2009-November/011678.html)
+         - firegpg <unfixed> (embed)
+         - enigmail <unfixed> (embed)
+ ptmalloc (not packaged in Debian)
+         - crystalspace <unfixed> (embed)
+         - qt4-x11 <unfixed> (embed)
+ svgalib
+         - usplash <unfixed> (embed)
+ bogl
+         - usplash <unfixed> (embed)
+ taglist
+         - usplash <unfixed> (embed)
+ portaudio
+         - audacity <unfixed> (embed; bug #323711)
+ nyquist
+         - audacity <unfixed> (embed)
+         NOTE: embeds a forked nyquist with support for a shared library
+ vamp-plugin-sdk
+         - audacity <unfixed> (embed)
+ wordpress
+         - libwordpress-xmlrpc-perl <removed> (embed) [./xmlrpc.php]
+ php5
+         - php4 <removed> (old-version)
+ classpath
+         - libgnucrypto-java <unfixed> (embed; bug #559788)
+ libtool
+         - apr <unfixed> (static; bug #489625)
+         NOTE: ships copy of libtool in libapr1-dev; was 'embed' before 1.3.2-3
+         - arts <unfixed> (embed)
+         - bochs <unfixed> (embed; bug #560884)
+         - camserv <unfixed> (embed)
+         - collectd <unfixed> (embed)
+         - courier-authlib 0.58-4 (embed)
+         NOTE: The etch version of courier-authlib was the earliest version checked, might be fixed earlier
+         - cvsnt <unfixed> (embed)
+         - dico <not-affected> (Uses the system copy of ltdl)
+         - freeradius 0.1+20010527-1 (embed)
+         NOTE: Earliest reference I could find from the changelog is from 27 May 2001
+         - ggobi 2.1.9~20091212-1 (embed)
+         - glame <unfixed> (embed)
+         - gnash <unfixed> (embed)
+         - gnu-smalltalk <unfixed> (embed)
+         - google-gadgets <unfixed> (embed)
+         - graphicsmagick 1.3.5-6 (embed)
+         - graphviz 2.8-3 (embed)
+         NOTE: The etch version of graphviz was the earliest version checked, might be fixed earlier
+         - guile-1.6 1.6.8-7 (embed)
+         - hamlib <unfixed> (embed)
+         - hercules <unfixed> (embed)
+         - jags 1.0.4-3 (embed; bug #560864)
+         - kdelibs <unfixed> (embed)
+         - libannodex <removed> (embed)
+         - libextractor <unfixed> (embed)
+         - libmcrypt <not-affected> (libtool source present but not included in any of the binary packages)
+         - libtunepimp <unfixed> (embed)
+         - mp4h <unfixed> (embed)
+         - naim <unfixed> (embed)
+         - parser-mysql <unfixed> (embed)
+         - pinball <unfixed> (embed)
+         - redland <unfixed> (embed)
+         - siproxd <unfixed> (embed)
+         - ski <unfixed> (embed)
+         - synfig <unfixed> (embed)
+         - unixodbc 2.2.4-5 (embed)
+         - xmlsec1 <not-affected> (Doesn't enable dynamic loading of crypto modules)
+         - clamav 0.95+dfsg-1 (embed)
+         - imagemagick <unfixed> (embed)
+         - hypre 2.4.0b-5 (embed)
+         - lam <unfixed> (embed)
+         - openmpi <unfixable> (embed; bug #559386)
+         - parser <unfixed> (embed)
+         - pdsh 2.18-5 (embed; bug #560892)
+         - sbnc 1.2-8 (embed)
+         - sdcc <unfixed> (embed)
+         - wml <unfixed> (embed)
+         - proftpd-dfsg <unfixed> (embed; bug #561748)
+         - babel 1.4.0.dfsg-5 (embed)
+         - libprelude 0.9.14-2 (embed)
+         - heartbeat 2.1.4-7 (embed)
+         NOTE: From Squeeze onwards the system copy of ltdl is used, use the current version from Squeeze,
+         NOTE: might've been fixed earlier
+         - gcc-* <unknown> (embed)
+ ocamlgsl
+         - orpie 1.5.1-7.1 (embed; bug #550058)
+ xdotool
+         - keynav <unfixed> (embed; bug #560103)
+ bulletphysics (not packaged; http://www.bulletphysics.org/)
+         - supertuxkart <unfixed> (embed)
+ ghostscript
+         - gs-gpl <removed> (old-version)
+ icedove
+         - thunderbird <removed> (old-version)

 Legend:



Removed from v.13435
 


changed lines


 
Added in v.13612
 Legend:



Removed from v.13435
 


changed lines


 
Added in v.13612
-Removed from v.13435
+Added in v.13612

	ViewVC Help
Powered by ViewVC 1.1.5