/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 7212 by jmm-guest, Sun Nov 4 17:30:38 2007 UTC revision 13523 by jwilk-guest, Sat Dec 12 10:44:22 2009 UTC
# Line 1  Line 1 
1  This file collects cases, where a source package embeds code from  Embedded code copies
2  other projects, without linking dynamically:  ====================
3    
4  xpdf code: (some use xpdf 2, some xpdf 3)  This file collects source packages that embed code from other projects.
5  gpdf (has been replaced by evince - which uses poppler - in Etch)  This is considered bad for fixing security flaws because the fix needs
6  pdftohtml (has been replaced by poppler-utils from the poppler source package, still in Etch, though)  to be applied in multiple source packages.
7  kdegraphics/kpdf (okular, the kpdf replacement in KDE 4 is using poppler, #436164)  
8  tetex-bin (links to poppler since 3.0-12)  Format:
9  cupsys (uses xpdf-utils, it's still present in the src, though)  <srcpkg> (<optional comment about srcpkg>)
10  poppler          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11  koffice/kword (upstream is working on using poppler, #436163)          NOTE: optional comments about the linkage of the embedding srcpkg
12  libextractor (uses internal pdf decoder since 0.5.12-1)  
13  pdfkit.framework (links to poppler since 0.8-4)  status: version number fixing the embedded copy, <unfixed>, <removed>,
14  ipe (only small parts, but with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp)          <itp>, <not-affected>, <unknown> if the version number can not
15            be determined, or <unfixable> for unavoidable cases (e.g., forks
16  silc-toolkit:          that add real value)
17  silc-client (uses libsilc and libsilcclient)  sort: static (linking statically against a lib)
18          embed (embedding a copy of the library into another source package)
19  dietlibc:        fork (the package is not just embedding code but it is a fork and
20  ccontrol (links statically)              thus might share parts of the source code)
21          old-version (the package is an older version of essentially
22  libiax:                     the same code)
23  iaxmodem  
24    The srcpkg might be some string to identify the code if there is no
25  zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  specific source package.
26  dpkg  
27  rsync (somehow derived code base)  Everything up to the next line is ignored.
28  mono  ---BEGIN
29  mozilla(?)  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
30  Linux kernels          NOTE: Fixed packages link to poppler library unless otherwise noted
31  pvpgn (links dynamically since 1.7.8-2)          - pdftohtml <unknown>
32  mrtg (links dynamically since 2.12.2-1)          [sarge] - pdftohtml <unfixed>
33  rpm          [etch] - pdftohtml <unfixed>
34            NOTE: has been replaced by poppler-utils
35  libbz2:          - kdegraphics 4:4.2.2-1 (embed; bug #436164)
36  dpkg (statically linked)          - texlive-base 3.0-12 (embed)
37            - texlive-bin 2007-1 (embed)
38  libgadu/ekg:          NOTE: links to poppler
39  centericq          - koffice <unfixed> (embed; bug #436163)
40  gaim          - libextractor 0.5.12-1 (embed)
41  kopete (ships the code, but links dynamically in the Debian package)          NOTE: libextractor is using its own pdf decoder now
42  kadu (not packaged in Debian)          - ipe <unfixed> (embed)
43  GNU gadu (not yet packaged in Debian)          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
44            - ruby-gnome2 <unknown> (embed)
45  xmlrpc: (which package is the "origin" of this code?)          NOTE: copy only present in source but links to poppler
46  drupal          - pdfedit <unfixed> (embed; bug #510794)
47  phpgroupware          - swftools <unfixed> (embed; bug #551293)
48  egroupware          - poppler <unfixable> (fork)
49  phpwiki  
50  php4 (php-pear, IIRC this was reorganized some weeks ago?)  ppmd
51  tikiwiki          - libcomplearn-mod-ppmd <unfixed> (fork)
52            NOTE: discussion in #458152
53  shtool: (affects build-time only)  
54  mysql-ocaml  libevent
55  php4          - transmission 1.71-1 (embed; bug #529372)
56    
57  mozilla:  lrmi
58  mozilla-firefox          - read-edid 2.0.0-1 (embed; bug #495131)
59  mozilla-thunderbird          - s3switch <unfixed> (embed)
60  firefox (to be removed)          - xresprobe <unfixed> (embed)
61  thunderbird (to be removed)          - zhcon <unfixed> (embed)
62  iceweasel  
63  iceape  peercast
64  icedove          - gnome-peercast <removed> (embed)
65  xulrunner          [etch] - gnome-peercast <unfixed> (embed)
66  nvu (no longer in Debian)  
67    silc-toolkit
68  xli:          - silc-client 1.1~beta6-1 (embed)
69  xloadimage  
70    icclib
71  lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)          - ghostscript <unfixed> (embed)
72  openmotif          - argyll <unfixed> (embed)
73  xfree86/xorg (in libxpm)  
74    dietlibc
75  kerberized apps with BSD origin:          - ccontrol 0.9.1+20071204-1 (static)
76  krb4  
77  krb5  libmikmod
78  heimdal          - sdl-mixer1.2 <unfixed> (embed)
79            TODO: report bug
80  grip: (which pkg is the origin?)  
81  libcdaudio  libiax
82  grip          - iaxmodem <unfixable> (embed; bug #548885)
83  gnome-vfs (vfs2 as well?)  
84    spandsp
85  fudforum:          - iaxmodem <unfixable> (embed; bug #548885)
86  phpgroupware-fudforum  
87  egroupware-fudforum (removed from egroupware after sarge)  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
88            - dpkg <unfixed> (static)
89  cvs:          NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
90  gcvs (at least an additional script is included, check if there's more)          - rsync <unfixed> (embed)
91            NOTE: somehow derived code base
92  pcre:          - mono <unfixed> (embed)
93  all pythons          TODO: check mozilla
94  php4 (src included, but Debian package links dynamically)          - Linux kernels <unfixed> (embed)
95  analog (src included, but Debian package links dynamically)          - pvpgn 1.7.8-2 (embed)
96  libgoffice-1          - mrtg 2.12.2-1 (embed)
97  vfu          - rpm <unknown> (embed)
98  tf5 (since 5.0beta7 the Debian package links dynamically)          NOTE: pinged anibal since when rpm was fixed
99  monotone (including this starting from 0.37)          - tuxcmd-modules <unfixed> (embed)
100            - zsync <unfixed>
101  tiff:          - tra <unfixed>
102  wxpythongtk (check, which debian pkg this is in)          - sash <unfixed>
103  older kdegraphics/kpdf releases < 3.3 embedded a copy          - nsis <unfixed>
104            - mseide-msegui <unfixed>
105  uudeview:          NOTE: mseide
106  libconvert-uulib-perl          - mirrordir <unfixed>
107            - poco <unfixed>
108  sqlite: (not affected by security vulnerabilities so far)          - klibc <unfixed>
109  amarok          - ghostscript <unfixed>
110  monotone          - freeimage <unfixed>
111  iceweasel          - clamav <unfixed> (fork)
112            NOTE: from the changelog: "libclamav6 does indeed duplicate parts of the zlib code, but there is not way around that"
113  util-linux/mount:          - tuxonice-userui <unfixed>
114  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb          - plt-scheme <unfixed>
115            - perl <unfixed>
116  webmin:          - paraview <unfixed>
117  usermin (only in sarge)          - gcvs <unfixed>
118            - dump <unfixed>
119  sylpheed:          - aide <unfixed> (static)
120  sylpheed-claws          - dar <unfixed> (static)
121            - avfs <unfixed>
122  phpsysinfo:          - fpc <unfixed>
123  egroupware          - winff <unfixed>
124  phpgroupware          NOTE: inherited from fpc, see #472304
125            - lazarus <unfixed>
126  phpldapadmin:          NOTE: inherited from fpc, see #472304
127  egroupware (removed from egroupware after sarge)          - erlang <unfixed> (embed)
128            - gamera 3.2.3-1 (embed)
129  chmlib:          - python2.4 <unfixed> (embed; bug #553403)
130  kchmviewer (not packaged in Debian)          - python2.5 <unfixed> (embed; bug #553403)
131    
132    dulwich
133            - hg-git 0.1.0-1 (embed; bug #541996)
134    
135    libvigraimpex
136            - hugin <unfixed> (embed; bug #542259)
137            - enblend-enfuse <unfixed> (embed; bug #542258)
138            - gamera 3.2.3-1 (embed)
139    
140    libbz2
141            - dpkg <unfixed> (static)
142    
143    libgadu
144            - centerim <unfixed> (embed; bug #559783)
145            - pidgin <not-affected> (links dynamically since initial release; fixed in gaim)
146            - gaim 1:2.0.0+beta3-3 (embed; bug #360280)
147            - kdenetwork 4:3.3.2-5 (embed)
148            NOTE: from kdenetwork: kopete
149            - ekg 1:1.8~rc0-1 (embed)
150            - kadu 0.6.0.2-3 (embed; bug #504430)
151            - gadu <itp> (embed)
152    
153    xmlrpc (which package is the "origin" of this code?)
154            - drupal <unfixed> (embed)
155            - phpgroupware <unfixed> (embed)
156            - egroupware <unfixed> (embed)
157            - phpwiki <unfixed> (embed)
158            - php4 <unfixed> (embed)
159            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
160    
161    shtool (affects build-time only)
162            - mysql-ocaml <unfixed> (embed)
163            - php4 <unfixed> (embed)
164    
165  libavcodec/libavformat:  iceape
166  ffmpeg          - iceweasel <unfixed> (fork)
167  xine-lib          - icedove <unfixed> (fork)
168  xvidcap          - xulrunner <unfixed> (fork)
169  kino (links statically, does not include code)          - kompozer <unfixed> (embed; bug #532168)
170  vlc (links statically, does not include code)          - galeon <unfixed> (fork)
171  smilutils (links statically, does not include code)          - epiphany-browser <unfixed> (fork)
172  motion (links statically, does not include code)          - conkeror <unfixed> (fork)
173  gst-ffmpeg          - kazehakase <unfixed> (fork)
174  gstreamer0.10-ffmpeg  
175  xmovie  xli
176            - xloadimage <unfixed> (embed)
177  mad MPEG decoding lib:  
178  mad  lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
179  xine-lib          - openmotif <unfixed> (embed)
180            - libxpm <unfixed> (embed)
181    
182    kerberized apps with BSD origin
183            - krb4 <removed> (embed)
184            - krb5 <unfixed> (embed)
185            - heimdal <unfixed> (embed)
186    
187    grip (which pkg is the origin?)
188            - libcdaudio <unfixed>
189            - grip <unfixed>
190            - gnome-vfs <unfixed>
191            TODO: check vfs2 as well
192    
193    fudforum
194            [etch] - phpgroupware <unfixed> (embed)
195            NOTE: phpgroupware-fudforum
196            [sarge] - egroupware-fudforum <removed> (embed)
197    
198    libbsd
199            - rdate 1:1.2-3 (embed)
200            - atheme-services <unfixed>
201            - libbsd-arc4random-perl <unfixed>
202            - isakmpd <unfixed>
203            - bsdgames <unfixed> (embed)
204            - bsd-mailx <unfixed> (embed)
205            - netcat-openbsd <unfixed> (embed; bug #550611)
206            - openssh <unfixed> (embed)
207            - unworkable <unfixed> (embed)
208    
209    cvs
210            - gcvs <unfixed> (embed)
211            NOTE: see cvsunix/src in tarball
212    
213    pcre3
214            - php4 <unknown> (embed)
215            - analog 2:5.23-0woody1 (embed)
216            - goffice <unfixed> (embed)
217            NOTE: libgoffice-*
218            - vfu 4.06-4.1 (embed; bug #450754)
219            - tf5 5.0beta7-1 (embed)
220            - monotone 0.43-1 (embed)
221            NOTE: this only affects versions >= 0.37
222            - glib2.0 2.15.2-1 (embed)
223            - apache2 2.0.53-4 (embed)
224            - exim4 4.10-0.srh20.12 (embed)
225            - yacas <unfixed> (embed)
226            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
227            - gtamsanalyzer.app 0.42-5 (embed)
228            - tin 980117-1 (embed)
229            - kazehakase 0.5.2-1
230            - webkit 1.0.1-1 (embed)
231            - qt4-x11 <unfixed> (embed)
232            NOTE: embedded via webkit copy
233            - erlang <unfixed> (embed)
234    
235    tiff
236            - wxwindows2.4 2.2.1 (embed)
237            - gamera 3.2.3-1 (embed)
238    
239    uudeview
240            - libconvert-uulib-perl <unfixed> (embed)
241            - pan <unfixed> (embed)
242    
243    sqlite (not affected by security vulnerabilities so far)
244            - amarok <unfixed> (embed)
245            - monotone 0.43-1 (embed)
246            - iceweasel <unfixed> (embed)
247            - heimdal <unfixed> (embed; bug #559616)
248    
249    util-linux/mount
250            - loop-aes-utils <unfixed> (embed)
251            NOTE: contains code from util-linux' mount in the mount-aes-udeb
252    
253    sylpheed
254            - sylpheed-claws <unfixed> (fork)
255    
256    phpsysinfo
257            - egroupware <unfixed> (embed)
258            - phpgroupware <unfixed> (embed)
259    
260    phpldapadmin
261            [sarge] - egroupware <unfixed> (embed)
262            NOTE: removed from egroupware after sarge
263    
264    chmlib
265            - kchmviewer <unknown> (embed)
266    
267    ffmpeg (libavcodec/libavformat)
268            - mplayer 1.0~rc2-14 (embed; bug #395252)
269            - kino 1.0.0-1
270            - vlc <not-affected> (Links dynamically since initial release)
271            - smilutils 0.3.0-10
272            NOTE: smilutils likely fixed earlier, marking Etch's version as fixed
273            - motion 3.1.19-1
274            - gstreamer0.10-ffmpeg 0.10.3-2
275            - xmovie <removed> (static)
276            TODO: gimp-gap (potentially using ffmpeg code as well)
277            - avifile 1:0.7.48~20090503.ds-1 (embed; bug #538750)
278            - audacity 1.3.7-2 (embed; bug #512278)
279    
280    faad2
281            - mplayer 1.0~rc2-20 (embed)
282            - avifile <unfixed> (embed; bug #538750)
283            - ffmpeg-debian <removed> (old-version)
284    
285    libmad (MPEG decoding lib)
286            - xine-lib <unfixed> (embed)
287            - avifile 1:0.7.48~20090503.ds-1 (embed) [./plugins/libmad/*]
288            TODO: check ocaml-mad, madplay, pymad, xmms-mad, xmms2
289    
 libdts:  
290  libdts  libdts
291  xine-lib          - xine-lib <unfixed> (embed)
292    
 flac:  
293  flac  flac
294  xine-lib          - xine-lib <unfixed> (embed)
   
 liba52:  
 a52dec  
 xine-lib  
   
 libmpeg2:  
 mpeg2dec  
 xine-lib  
   
 curl:  
 wget (code for NTLM authentication)  
   
 TODO evaluate:  
 gimp-gap (potentially using ffmpeg code as well)  
   
 uw-imap:  
 pine  
 alpine  
   
 imagemagick:  
 graphicsmagick  
   
 halibut:  
 nsis  
   
 libghttp:  
 hotway  
   
 libsndfile:  
 ardour  
   
 glibmm2.4:  
 ardour  
   
 libgnomecanvasmm2.6:  
 ardour  
   
 libsigc++-2.0:  
 ardour  
295    
296  soundtouch:  liba52
297  ardour          - a52dec <unfixed> (embed)
298            - xine-lib <unfixed> (embed)
299    
300    libmpeg2
301            - mpeg2dec <unfixed> (embed)
302            - xine-lib <unfixed> (embed)
303    
304    libntlm
305            - wget <unfixed> (fork; bug #550436)
306            - curl <unfixed> (fork; bug #550437)
307            - cntlm <unfixed> (fork; bug #550438)
308    
309    uw-imap
310            - pine <unfixed> (embed)
311            - alpine <unfixed> (embed)
312    
313    imagemagick
314            - graphicsmagick <unfixed> (fork)
315    
316    python-urlgrabber
317            - mercurial <unfixed> (embed; bug #531062)
318            - w3af <unfixed> (embed; bug #555372)
319            [experimental] - harvestman <unfixed> (embed; bug #555373)
320    
321    beautifulsoup
322            - python-mechanize <unfixed> (embed; bug #555349)
323            - zope2.11 <unfixed> (embed; bug #555350)
324            - twill <unknown> (embed)
325    
326    halibut
327            - nsis <unfixed> (fork)
328    
329    libghttp
330            - hotway <unfixed> (embed)
331    
332    libsndfile
333            - ardour 1:2.7.1-1 (embed)
334    
335    glibmm2.4
336            - ardour 1:2.7.1-1 (embed)
337    
338    libgnomecanvasmm2.6
339            - ardour 1:2.7.1-1 (embed)
340    
341    libsigc++-2.0
342            - ardour 1:2.7.1-1 (embed)
343    
344    soundtouch
345            - ardour 1:2.7.1-1 (embed)
346    
347    libmms
348            - xine-lib <unfixed> (embed)
349            - mimms <unfixed> (embed)
350    
351    fckeditor
352            - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
353            - moin 1.8.2-2 (embed; bug #452599)
354            - karrigell <removed> (embed; bug #452598)
355            - gforge 4.6.99+svn6225-1 (embed)
356            - request-tracker3.8 <unfixed> (embed)
357    
358    ipatlas (not packaged in Debian)
359            - moodle <unfixed> (embed; bug #507185)
360    
361    libphp-phpmailer
362            - moodle <unfixed> (embed; bug #507185)
363            - mahara <unfixed> (embed)
364            - symfony <unfixed> (embed)
365            [etch] - phpgroupware <unfixed> (embed)
366            NOTE: phpgroupware-felamimail is only in etch
367            - egroupware <unfixed> (embed; bug #504283)
368            - glpi <unfixed>
369    
370    htmlArea (not packaged in Debian)
371            - moodle <unfixed> (embed)
372    
373    giflib
374            - wine <unfixed> (embed; bug #466181)
375    
376    bennu (not packaged in Debian, http://bennu.sourceforge.net)
377            - moodle <unfixed> (embed)
378    
379    smarty
380            - moodle 1.8.2-2 (embed; bug #471158)
381            - gallery2 2.2.5-2 (embed; bug #471160)
382            - mahara 0.9.2-2 (embed; bug #471201)
383            - gosa 2.4beta1-1 (embed; bug #471200)
384    
 libmms:  
 xine-lib  
 mimms  
   
 FCKeditor:  
 knowledgeroot  
 moin  
 karrigell  
 gforge-plugins-extra  
   
 Moodle contains lots of things:  
 AdoDB  
 AdoDB-XML Schema  
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
385  TinyMCE  TinyMCE
386  bennu          - wordpress 2.5.1-3 (embed; bug #478257)
387            - moodle <unfixed> (embed; bug #507185)
388  TinyMCE:          - knowledgeroot <unfixed> (embed)
389  wordpress          - joomla <itp> (bug #326398)
390  moodle  
391  knowledgeroot  scintilla (upstream provides static lib, rejected shared lib http://sf.net/support/tracker.php?aid=2488121)
392  joomla (ITP)          - scite <unfixed> (embed)
393            - qscintilla <unfixed> (embed)
394  scintilla:          - qscintilla2 <unfixed> (embed)
395  scite          - geany <unfixed> (fork)
396  qscintilla          - anjuta <unfixed> (embed)
397  qscintilla2  
398  geany  libphp-adodb
399            - moodle <unfixed> (embed; bug #507185)
400  libphp-adodb:          NOTE: also AdoDB-XML Schema
401  gallery2          - gallery2 <unfixed> (embed)
402  phppgadmin          - phppgadmin <unfixed> (embed)
403  egroupware          - egroupware <unfixed> (embed)
404  phpwiki          - phpwiki <unfixed> (embed)
405  moodle          - torrentflux 2.0beta1-2 (embed)
406  cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)          - ipplan <unfixed> (embed)
407            - typo3-src <unfixed> (embed)
408  gzip:          - cacti <unknown> (embed)
409  linux-kernel (lib/inflate.c)          [sarge] - cacti <unfixed> (embed)
410  klibc (based on linux-kernel gzip code)          NOTE: dependency exists, but internal version is used
411  busybox          - gforge 4.7~rc2-6 (embed)
412            - mahara <unfixed> (embed)
413  ffmpeg:  
414  mplayer (#395252)  gzip
415            - linux-kernel <unfixed> (embed)
416  neon:          NOTE: lib/inflate.c
417  cadaver (all, but being worked on: #188381)          - klibc <unfixed> (embed)
418  gnome-vfs2 (#395874)          NOTE: based on linux-kernel gzip code
419  litmus (#395875)          - busybox <unfixed> (embed)
420  screem (sarge only)  
421  sitecopy (#395876)  neon
422  tla (etch/sid only: #395877)          - cadaver 0.22.3+debian-1 (embed; bug #188381)
423            - gnome-vfs2 <unfixed> (embed; bug #395874)
424  libmodplug:          [etch] - litmus <unfixed> (embed; #395875)
425  gst-plugins-bad0.10          - litmus <removed> (embed; #395875)
426            [sarge] - screem <unfixed> (embed)
427  libvncserver:          - sitecopy 1:0.16.3-5 (embed; bug #395876)
428  vino          [etch] - tla <unfixed> (embed; bug #395877)
429            [sarge] - tla <unfixed> (embed; bug #395877)
430    
431    libmodplug
432            - gst-plugins-bad0.10 <unfixed> (embed)
433    
434    libvncserver
435            - vino <unfixed> (embed)
436    
437    putty
438            - filezilla <unfixed> (embed)
439    
440    tinyxml (not packaged in Debian; itp bug #531968)
441            - filezilla <unfixed>
442            - crystalspace <unfixed> (embed)
443            - libwfut <unfixed> (embed)
444            - rarian <unfixed> (embed)
445            - bulletml <unfixed> (embed)
446            - pokerth <unfixed> (embed)
447            - qutecom <unfixed> (embed)
448            - sofa-framework <unfixed> (embed)
449            - yate <unfixed> (embed)
450            - antigrav <unfixed> (embed)
451            - balder2d <unfixed> (embed)
452            - cal3d <unfixed> (embed)
453            - criticalmass <unfixed> (embed)
454            - ember <unfixed> (embed)
455            - epiphany <unfixed> (embed)
456            - gambit <unfixed> (embed)
457            - noiz2sa <unfixed> (embed)
458            - ogre <unfixed> (embed)
459            - opencity <unfixed> (embed)
460            - openmovieeditor <unfixed> (embed)
461            - pouetchess <unfixed> (embed)
462            - tecnoballz <unfixed> (embed)
463            - trigger-rally <unfixed> (embed)
464            - xmoto <unfixed> (embed)
465            - mapnik <unknown> (embed)
466            NOTE: uses a different XML parser by default
467            - rrootage 0.23a-6 <embed>
468            NOTE: links to libbulltetml
469            - boson <unknown> (embed)
470            NOTE: the embedded code is unused
471    
472    gv
473            - evince <unfixed> (embed)
474            NOTE: ps/ tree from gv 3.5.8
475            NOTE: evince-gtk is affected (a component of evince source package)
476    
477    libXbae
478            - paw <removed> (embed)
479            [etch] - paw <unfixed> (embed)
480    
481    libgtkhtml
482            - claws-mail-extra-plugins <unfixed> (fork)
483    
484    libXaw
485            - paw <removed> (embed)
486            [etch] - paw <unfixed> (embed)
487            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
488    
489    libgd2
490            - graphviz <unfixed> (embed)
491            NOTE: lib/gd seems to be 2.0.33
492            - wml <unfixed> (embed)
493            - libwmf <unfixed> (embed)
494            NOTE: derived from gd 1.6.3
495    
496    rar
497            - unrar-nonfree <unfixed> (embed)
498    
499    unrar-free (maybe this code is derived from the original rar, too?)
500            - clamav <unfixed> (embed)
501            NOTE: seems to be disabled in default config
502    
503    mplayer (DirectMedia Object loader)
504            - xine-lib <unfixed> (embed)
505            NOTE: src/libw32dll/
506            - vlc <unfixed> (embed)
507            NOTE: modules/codec/dmo/
508            - mplayer 1.0~rc2-20 (embed)
509    
510    libwpd (WordPerfect converter)
511            - openoffice.org <unfixed> (embed)
512    
513    fsplib (http://sourceforge.net/projects/fsp/)
514            - gftp <unfixed> (embed)
515            NOTE: lib/fsplib version 0.3
516    
517    sprng
518            - tree-puzzle <unfixed> (embed)
519    
520    librpcsecgss
521            - krb5 <unfixed> (embed)
522    
523    jasper
524            - ghostscript 8.70~dfsg-2+b1 (embed)
525            - ghostscript <unfixed> (static)
526    
527    libiris
528            - psi <unfixed> (embed)
529            - kdenetwork <unfixed> (embed)
530            NOTE: kopete embeds libiris but links dynamically to libidn
531            - kdegames <unfixed> (embed)
532            NOTE: ksirk/kde4
533    
534    libidn
535            - monotone 0.43-1 (embed)
536            - psi <unfixed> (embed)
537            NOTE: psi embeds libiris which embeds libidn
538            - kdegames <unfixed> (embed)
539            NOTE: kdegames/kde4 embeds libiris which embeds libidn
540    
541    liblua
542            - monotone 0.43-1 (embed)
543            - nmap 5.00-1 (embed; bug #527997)
544            [lenny] - nmap <unfixed> (embed; bug #527997)
545            - ocropus <unfixed> (embed)
546            - enigma <unfixed> (embed)
547            NOTE: requires lua built with C++
548            - freeciv <unfixed> (embed)
549    
550    libbotan
551            - monotone 0.43-1 (embed)
552    
553    NetXX
554            - monotone 0.43-1 (embed)
555    
556    libgc
557            - mono <unfixed> (embed)
558    
559    lzma
560            - p7zip <unfixed> (embed)
561            - xz-utils <unfixed> (fork)
562    
563    lzo
564            - grub2 <unfixed> (embed)
565    
566    yassl
567            - mysql-dfsg-5.0 <unfixed> (embed)
568    
569    pax code
570            - tar <unfixed> (embed)
571            - cpio <unfixed> (embed)
572    
573    t1lib
574            - tetex-bin 2.0.2-1 (embed)
575            - texlive-bin <unknown> (embed)
576    
577    guichan
578            - boswars <unfixed> (embed)
579            NOTE: maintainer notified us, working on it
580    
581    tolua
582            - boswars <unfixed> (embed)
583            NOTE: maintainer notified us, working on it
584            NOTE: actually tolua++
585            - ocropus <unfixed> (embed)
586            NOTE: actually tolua++
587            - freeciv <unfixed> (embed)
588            NOTE: actually tolua++
589            - enigma <unfixed> (embed)
590    
591  putty:  asio-dev
592  filezilla          - luxrender <removed> (embed)
593    
594  tinyxml (not packaged in Debian):  xine-lib
595  filezilla          - vlc <unfixed> (embed)
596            NOTE: only parts included in modules/access/rtsp
 gv:  
 evince (ps/ tree from gv 3.5.8)  
 evince-gtk (not packaged in Debian)  
   
 libXbae:  
 libpawlib2-lesstif package (from Cernlib)  
   
 libXaw:  
 libpawlib2-lesstif package (from Cernlib)  
597    
598  (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  netpbm
599            - tcl8.3 <unfixed> (embed)
600            - tcl8.4 <unfixed> (embed)
601            - tcl8.5 <unfixed> (embed)
602            NOTE: generic/tkImgGIF.c
603    
604    tk8.5
605            - tk8.0 <removed> (old-version)
606            - tk8.3 <unfixed> (old-version)
607            - tk8.4 <unfixed> (old-version)
608            - perl-tk <unfixable> (fork)
609    
610    samba
611            - mc 2:4.6.2~git20080311-1 (embed)
612            NOTE: maintainer is aware of this, currently searching a solution
613    
614    plib1.8.4c2
615            - boson <unfixed> (fork)
616            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
617    
618    fribidi
619            - quesoglc <unfixed> (embed)
620            NOTE: compiled against system fribidi in Debian - embed only used when fribidi is not available on the system
621    
622    glew
623            - quesoglc <unfixed> (embed; bug #489341)
624            NOTE: waiting on GLEW_MX version of glew (see bug #474488)
625            - trigger <unfixed> (embed)
626            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
627            - trigger-rally <unfixed> (embed)
628            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
629    
630    minorGems (pabs contacted upstream about shared lib, he considers minorGems an 'ever-evolving collection of reusable code fragments' for his own use)
631            - transcend <unfixed> (embed)
632            - cultivation <unfixed> (embed)
633            - passage <unfixed> (embed)
634            - gravitation <unfixed> (embed)
635    
636  libgd2:  tar
637  graphviz (lib/gd seems to be 2.0.33)          - libarchive <unfixed> (embed)
638            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
639    
640  rar:  cpio
641  unrar-nonfree          - libarchive <unfixed> (embed)
642            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
643    
644  unrar-free: (maybe this code is derived from the original rar, too?)  webkit
645  clamav (seems to be disabled in default config)          - qt4-x11 <unfixed> (embed; bug #479851)
646            - kdelibs <unfixed> (old-version)
647            - kde4libs <unfixed> (fork)
648    
649    ftgl
650            - blender 2.46+dfsg-1 (embed)
651    
652    wv
653            - abiword <unfixed>
654    
655    qemu
656            - kvm <unfixed> (embed; bug #543159)
657            - xen-3 <unfixed> (embed)
658            - xen-unstable <unfixed> (embed)
659    
660    vgabios
661            - kvm <unfixed> (embed; bug #489442)
662    
663    bochs
664            - kvm <unfixed> (embed; bug #489442)
665    
666    speex
667            - vorbis-tools <unfixed> (embed)
668            NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
669            - gst-plugins-good0.10 <unfixed> (embed)
670            - xine-lib <unfixed> (embed)
671            - libfishsound <unfixed> (embed)
672            - libannodex <removed> (embed)
673            - vlc <unfixed> (embed)
674            - xmms-speex <unfixed> (embed)
675            - libsdl-sound1.2 <unfixed> (embed)
676            - sweep <unfixed> (embed)
677    
678    libreadline
679            - magic <itp> (old-version)
680    
681    opcode
682            - ode <unfixed> (embed)
683            NOTE: opcode is not a package in debian, it is just embedded
684            NOTE: http://www.codercorner.com/Opcode.htm
685    
686    gimpact
687            - ode <unfixed> (embed)
688            NOTE: gimpact is not a package in debian, it is just embedded
689            NOTE: http://gimpact.sf.net
690    
691    mochikit
692            - mahara <unfixed> (embed)
693            NOTE: they require extra patches, still unmerged upstream
694            - ntop <unfixed> (embed)
695            - coherence 0.6.2-1 (embed)
696            - paste <unfixed> (embed)
697            - turbogears <unfixed> (embed)
698            - plone3 <unfixed> (embed)
699            - xulrunner <unfixed> (embed)
700            - libjifty-plugin-chart-perl <unfixed> (embed)
701            - sabnzbdplus <unfixed> (embed)
702            - tgmochikit <unfixed> (embed)
703    
704    prototypejs
705            - netbeans-ide 6.0.1+dfsg-2 (embed)
706            - auth2db 0.2.5-2+dfsg-1 (embed; bug #555218)
707            - webcit <unfixed> (embed; bug #555219)
708            - asterisk 1:1.6.2.0~rc3-1 (embed)
709            - libjson-ruby 1.1.4-1 (embed; bug #555224)
710            - lucene2 2.9.1+ds1-2 (embed; bug #555226)
711            - horde3 <unfixed> (embed)
712            - knowledgeroot <unfixed> (embed; bug #555230)
713            - mediatomb <unfixed> (embed; bug #555233)
714            - mt-daapd 0.9~r1696.dfsg-6lenny2 (embed)
715            - ebug-http <unfixed> (embed; bug #555236)
716            - phpgedview <removed> (embed)
717            - poker-network <unfixed> (embed; bug #555238)
718            - rails 2.1.0-6 (embed)
719            - wordpress 2.5.0-2 (embed; bug #555243)
720            - zope <not-affected> (the prototypejs embed is not in any of the obvious zope packages, e.g. zope2.9, zope2.10, zope2.11, and zope3)
721            TODO: search through all of the other zope packages
722            - ampache 3.4.1-2 (embed)
723            - exaile 0.2.14+debian-2.1 (embed; bug #555245)
724            - hobix 0.5~svn20070319-4 (embed; bug #555247)
725            - zabbix 1.6.6-4 (embed; bug #555250)
726            - chora2 <unfixed> (embed; bug #555253)
727            - gollem <unfixed> (embed; bug # 555254)
728            - jscropperui 1.2.1-1 (embed; bug #555257)
729            - scriptaculous <not-affected> (uses system prototype.js since initial upload; bug #555260)
730            - ingo1 <unfixed> (embed; bug #555261)
731            - kronolith2 <unfixed> (embed; bug #555262)
732            - activeldap <unfixed> (embed)
733            - libv8 <not-affected> (contains a google-specific implementation of prototype.js)
734            - mantis <unfixed> (embed; bug #555265)
735            - otrs2 2.3.4-6 (embed; bug #555267)
736            - webcalendar <unfixed> (embed; bug #555269)
737            - redmine 0.9.0~svn2907-1 (embed; bug #555270)
738            - jifty 0.90519-1 (embed; bug #555271)
739            - jquery <unfixed> (embed; bug #555272)
740            - passenger 2.2.5debian1-1 (embed; bug #555273)
741            - plone3 <unfixed> (embed; bug #555275)
742            - wesnoth <not-affected> (prototype.js not included in any of the binary packages; bug #555277)
743            - libhtml-prototype-perl 1.48-3 (embed; bug #538920)
744            - xulrunner <unfixed> (embed)
745            NOTE: included in iceweasel/xulrunner unit tests directory, so may not be security-relevant
746    
747    gdb
748            - insight <unfixed> (embed)
749    
750    e2fsprogs
751            - ldiskfsprogs <unfixable> (fork)
752    
753    quazip (not packaged in Debian)
754            - qcake <unfixed> (embed)
755            NOTE: starting with upstream version 0.6.4
756    
757    exo
758            - pcmanfm <unfixed> (embed; bug #499677)
759            NOTE: slightly modified source code
760    
761    java
762            - openjdk-6 <unfixed>
763            - sun-java5 <unfixed>
764            - sun-java6 <unfixed>
765    
766    libphp-snoopy
767            - ampache 3.4.1-2 (embed; bug #504169)
768            - gforge 4.6.99+svn6094-2 (embed)
769            - mahara 1.0.5-2 (embed; bug #504170)
770            - pixelpost 1.7.1-5 (embed; bug #504171)
771            - mediamate 0.9.3.6-5 (embed; bug #504172)
772            - opendb <removed> (embed; bug #504173)
773            [etch] - opendb <unfixed> (embed; bug #504173)
774            - wordpress 2.5.1-9 (embed; bug #443948)
775            - moodle <unfixed> (embed; bug #507185)
776            [etch] - phpgroupware <unfixed> (embed)
777            NOTE: phpgroupware-felamimail
778            - magpierss 0.72-3 (embed; bug #431089)
779    
780    jquery
781            - zekr <unfixed> (embed)
782            - wordpress <unknown> (embed)
783            - yocto-reader <unfixed> (embed)
784            - textpattern <unfixed> (embed)
785            - genshi 0.5.1-1 (embed)
786            NOTE: compressed file under examples/ dir
787            - prewikka <unfixed> (embed)
788            - libramaze-ruby <unfixed> (embed)
789            - drupal5 <unfixed> (embed)
790            - b2evolution <unfixed> (embed)
791            - wesnoth <unfixed> (embed)
792    
793    tablesorter (jquery plugin, not packaged yet)
794            - wesnoth <unfixed> (embed)
795    
796    kses
797            - wordpress <unfixed> (embed; bug #504242)
798            NOTE: their copy has all methods renamed to wp_<foo>
799            NOTE: kses isn't in Debian, RFP: #504240
800            - moodle <unfixed> (embed; bug #507185)
801            - egroupware <unfixed> (embed)
802    
803    magpierss
804            - wordpress <unfixed> (embed; bug #504242)
805            - moodle <unfixed>
806    
807    php-gettext
808            - wordpress 2.8.4-1 (embed; bug #504242)
809    
810    libphp-ixr (name may change, it is the Incutio XML-RPC)
811            - wordpress <unfixed> (embed; bug #504242)
812            NOTE: libphp-ixr isn't in Debian, RFP: #504236
813            - dokuwiki <unfixed> (embed)
814            - textpattern <unfixed> (embed)
815    
816    libphp-cas
817            - glpi <unfixed> (embed)
818            - moodle <unfixed> (embed; bug #505984)
819    
820    scriptaculous (prototype.js is among the embeds in the following)
821            - glpi <unfixed> (embed)
822            - libaws <unfixed> (embed; bug #555222)
823            - op-panel <unfixed> (embed)
824            - symfony <unfixed> (embed)
825            NOTE: maintainer says there are extra incompatible changes required
826            - pixelpost 1.7.1-6 (embed)
827            - webhelpers <unfixed> (embed)
828            - qwik <unfixed> (embed; bug #555241)
829            - smokeping <unfixed> (embed)
830            - turba2 <unfixed> (embed)
831            - typo3-src 4.2.3-1 (embed)
832            - request-tracker3.6 <unfixed> (embed)
833            - request-tracker3.8 <unfixed> (embed)
834            - rt-extension-emailcompletion <not-affected> (prototype.js not included in the binary package)
835            - wordpress 2.5.0-2 (embed)
836            - libhtml-prototype-perl 1.48-3 (embed)
837    
838    libmarkdown-php
839            - moodle <unfixed> (embed; bug #507185)
840            - pixelpost 1.7.1-6 (embed)
841    
842    php-openid
843            - wordpress-openid <itp> (embed)
844    
845    geshi
846            - dokuwiki 0.0.20080505-3.1 (embed)
847            - pgfouine 1.0-1.1 (embed)
848            - websvn 2.1.0-1 (embed)
849    
850    webcalendar
851            - gforge 4.7~rc2-6 (embed; bug #504758)
852    
853    libical
854            - kdepim <unfixed> (fork)
855            - kdepimlibs <unfixed> (fork)
856            NOTE: fixed in KDE4 post 4.1.x series
857            - claws-mail-extra-plugins <unfixed> (fork)
858    
859    libltdl3
860            - kdelibs <unfixed> (embed)
861            NOTE: it's been said it sets RT_GLOBAL (or something like that) at runtime and version in experimental of libltdl can optionally set it
862            - synfig <unfixed> (embed)
863    
864    harfbuzz
865            - qt4-x11 <unfixed> (embed)
866    
867    libzip
868            - php5 <unfixed> (fork)
869            - odt2txt <unfixed> (embed; bug #523808)
870    
871    json.php (not packaged; should be replaced with php's built-in functions)
872            - moodle <unfixed>
873            - yui <unfixed>
874            - gallery2 <unfixed>
875            - dokuwiki <unfixed>
876            - typo3-src <unfixed>
877    
878    php-fpdf
879            - tcpdf <itp> (fork)
880            - moodle <unfixed>
881            - phpwiki <unfixed>
882            - egroupware <unfixed>
883            - ldap-account-manager <unfixed> (fork)
884    
885    tcpdf (itp: #495985)
886            - moodle <unfixed>
887            - phpmyadmin <unfixed>
888    
889    typo3
890            - moodle <unfixed>
891    
892    spreadsheet_writeexcel (PHP port of libspreadsheet-writeexcel-perl; itp: #487557)
893            - moodle <unfixed>
894            - gosa <unfixed>
895    
896    php-ole (itp: #487558)
897            - moodle <unfixed>
898    
899    pieforms (http://www.catalyst.net.nz)
900            - mahara <unfixed>
901    
902    savant2 (http://phpsavant.com)
903            - egroupware <unfixed>
904    
905    rssparser (http://nwow.org)
906            - egroupware <unfixed>
907            - phpgroupware <unfixed>
908    
909    lcms
910            - openjdk-6 <unfixed> (fork)
911    
912    libphp-phplayersmenu
913            - diogenes <unfixed>
914            - phpldapadmin <unfixed>
915    
916    libphp-pclzip
917            - docvert <unfixed>
918            - moodle <unfixed>
919            - egroupware <unfixed>
920    
921    libphp-simplepie
922            - dokuwiki <unfixed>
923    
924    libphp-jpgraph
925            - egroupware <unfixed>
926    
927    php-simpletest
928            - moodle <unfixed>
929    
930    libpng
931            - iceweasel <not-affected> (uses xulrunner)
932            - icedove 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1, 2.0.0.19-1 (embed)
933            - iceape 1.0.13~pre080614i-0etch1 (embed)
934            - xulrunner 1.9.0.13-1 (embed)
935            [lenny] - xulrunner 1.9.0.11-0lenny1
936            [etch] - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
937            - gamera 3.2.3-1 (embed)
938    
939    irssi
940            - silc-client <unfixed> (embed)
941            NOTE: Seems to be a pre-0.8.12 version that is used in irssi-plugin-silc
942    
943    extc
944            - mtasc <unfixed> (embed)
945            - haxe <unfixed> (embed)
946    
947    swflib
948            - mtasc <unfixed> (embed)
949            - haxe <unfixed> (embed)
950    
951    libitext-java
952            - bouncycastle 2.1.4-1 (embed)
953    
954    python-ply
955            - pyke <unfixed> (embed; bug #555363)
956            - pywbem <unfixed> (embed; bug #555364)
957            - sepolgen <unfixed> (embed; bug #555365)
958            - zope-textindexng3 <unknown> (embed)
959            - iceweasel <not-affected> (uses xulrunner)
960            - xulrunner <unknown> (embed)
961            - wireshark <not-affected> (python-ply modules are not installed into binary packages; see #554613)
962    
963    libdumbnet (libdnet upstream)
964            - nmap <unfixed> (fork)
965    
966    gcc-4.4
967            - gcc-mingw32 <unfixed> (embed)
968    
969    camlimages
970            - advi <unfixed> (static; bug #550441)
971    
972    memcached
973            - memcachedb <unfixed> (embed)
974    
975    yajl
976            - argyll <unfixed> (embed; bug #544223)
977            NOTE: reference, confirmed by build logs: http://lists.debian.org/debian-mentors/2009/08/msg00062.html
978    
979    nusoap
980            - gforge 4.8.2-1 (embed)
981    
982    libept
983            - adept <unfixed> (embed; bug #540649)
984    
985    libvorbis
986            - iceweasel <not-affected> (uses xulrunner)
987            - xulrunner <unfixed> (embed; bug #540959)
988            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
989            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
990            - iceape <unfixed> (embed)
991            [etch] - iceape <not-affected> (introduced in 2.0)
992            [lenny] - iceape <not-affected> (introduced in 2.0)
993    
994    cairo
995            - iceweasel <not-affected> (uses xulrunner)
996            - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
997    
998    liboggz
999            - iceweasel <not-affected> (uses xulrunner)
1000            - xulrunner <unfixed> (embed; bug #540959)
1001            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1002            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1003            - iceape <unfixed> (embed)
1004            [etch] - iceape <not-affected> (introduced in 2.0)
1005            [lenny] - iceape <not-affected> (introduced in 2.0)
1006    
1007    liboggplay
1008            - iceweasel <not-affected> (uses xulrunner)
1009            - xulrunner <unfixed> (embed; bug #540959)
1010            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1011            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1012            - iceape <unfixed> (embed)
1013            [etch] - iceape <not-affected> (introduced in 2.0)
1014            [lenny] - iceape <not-affected> (introduced in 2.0)
1015    
1016    php-net-dnsbl
1017            - serendipity <unfixed> (embed)
1018    
1019    php-onyx-rss
1020            - serendipity <unfixed> (embed)
1021    
1022    php-text-wiki
1023            - serendipity <unfixed> (embed)
1024    
1025    php-xml-rpc
1026            - serendipity <unfixed> (embed)
1027    
1028    polarssl (does not have a shared library)
1029            - pdkim <itp> (embed; bug #543150)
1030            - xyssl <unfixed> (old-version)
1031    
1032    pidgin
1033            - gaim <removed> (old-version)
1034            - qutecom <unfixed> (embed; bug #559785)
1035    
1036    icu
1037            - webkit 1.0.1-1 (embed; bug #547214)
1038            - texlive-bin <unfixed> (fork)
1039            NOTE: texlive upstream working with icu upstream to merge their changes
1040    
1041    cyrus-imapd-2.2
1042            - kolab-cyrus-imapd <unfixed> (fork)
1043            - dovecot 1:1.2.1-1 (embed) [/dovecot-sieve/src/libsieve/*]
1044    
1045    python-cxx-dev
1046            - freecad 0.9.2646.3-1 (embed; bug #547936)
1047    
1048    zipios++
1049            - freecad 0.9.2646.3-1 (embed; bug #547941)
1050            - enigma 0.92.3-3 (embed)
1051            NOTE: likely fixed earlier, marking etch's version as fixed
1052    
1053    linux-2.6
1054            - kvm <unfixed> (embed; bug #549973) [./kernel/*]
1055            - linux-kbuild-2.6 <unfixed> (embed; bug #550379) [./kbuild/*]
1056            - kernel-source-2.6.8 <removed> (old-version)
1057            - kernel-source-2.4.27 <removed> (old-version)
1058            - kernel-source-2.4.24 <removed> (old-version)
1059            - kernel-source-2.2.25 <removed> (old-version)
1060            - kernel-source-2.2.20 <removed> (old-version)
1061    
1062    libfdt (not yet packaged separately for debian; http://www.jdl.com/software/)
1063            - kvm <unfixed> (embed) [./libfdt/*]
1064    
1065    qweb (not packaged)
1066            - ajaxterm <unfixed>
1067    
1068    opensaml2
1069            - opensaml <removed> (old-version)
1070    
1071    shibboleth-sp2
1072            - shibboleth-sp <removed> (old-version)
1073    
1074    tuxonice-userui
1075            - suspend2-userui <removed> (old-version)
1076    
1077    expat
1078            - w3c-libwww <removed> (embed; bug #551941)
1079            [etch] - w3c-libwww <unfixed> (embed; bug #551941) [./modules/expat/*]
1080            - python-xml <unfixed> (embed; bug #551940) [./extensions/expat/*]
1081            - python2.5 <unfixed> (embed; bug #553403) [./Modules/expat/*]
1082            - python2.4 <unfixed> (embed; bug #553403)
1083            - python-4suite <unfixed> (embed; bug #516935)
1084            - wxwindows2.4 <removed> (embed)
1085            - wxwidgets2.6 <unfixed> (embed)
1086            - wxwidgets2.8 <unfixed> (embed)
1087            - celementtree <unfixed> (embed)
1088            - audacity 1.3.2-1 (embed)
1089            - matanza <unfixed> (embed)
1090            - tdom <unfixed> (embed)
1091            - udunits <unfixed> (embed)
1092            - apr-util 1.2 (embed)
1093            - ayttm <unfixed> (embed)
1094            - cableswig <unfixed> (embed)
1095            - cadaver <unfixed> (embed)
1096            - cmake <unfixed> (embed)
1097            - coin3 <unfixed> (embed)
1098            - gdcm <unfixed> (embed)
1099            - ghostscript <unfixed> (embed)
1100            - grmonitor <unfixed> (embed)
1101            - iceape <unfixed> (embed)
1102            - insighttoolkit <unfixed> (embed)
1103            - libparagui1.1 <unfixed> (embed)
1104            - paraview <unfixed> (embed)
1105            - poco <unfixed> (embed)
1106            - simgear <unfixed> (embed)
1107            - sitecopy <unfixed> (embed)
1108            - smart 1.0-1 (embed)
1109            [etch] - smart <unfixed> (embed)
1110            - swish-e <unfixed> (embed)
1111            - tla <unfixed> (embed)
1112            - vtk <unfixed> (embed)
1113            - wbxml2 <unfixed> (embed)
1114            - xmlrpc-c <unfixed> (embed)
1115            - iceweasel <unfixed> (embed)
1116            - kompozer <unfixed> (embed)
1117            - vxl <unfixed> (embed)
1118            - xulrunner <unfixed> (embed)
1119            - apache2 2.2 (embed)
1120            - texlive-bin <unfixed> (embed) [included twice]
1121            - vnc4 <unfixed> (embed)
1122            - xotcl <unfixed> (embed)
1123    
1124    xerces-c
1125            - xerces-c2 <unfixed> (old-version)
1126            - xerces27 <removed> (old-version)
1127    
1128    md5 (RSA's version; not the gnu version provided by coreutils)
1129            - w3c-libwww <removed> (embed; bug #551942)
1130            [etch] - w3c-libwww <unfixed> (embed; bug #551942) [./modules/md5/*]
1131    
1132    enet
1133            - sauerbraten <unfixed> (embed; #497194)
1134    
1135    eglibc
1136            - glibc <removed> (old-version)
1137    
1138    galib
1139            - gamera 3.2.3-1 (embed)
1140    
1141    configobj
1142            - bzr <unfixed> (embed; bug #555336)
1143            - elisa <unfixed> (embed; bug #555337)
1144            - gaupol <unfixed> (embed; bug #555338)
1145            - ipython <unfixed> (embed; bug #555339)
1146            - pida <unfixed> (embed; bug #555340)
1147            - psychopy <unfixed> (embed; bug #555341)
1148            - rest2web <unfixed> (embed; bug #555342)
1149            - auth2db <unknown> (embed)
1150            - dynagen <unknown> (embed)
1151            - iceweasel <unknown> (embed)
1152            - sabnzbdplus <unknown> (embed)
1153            - xulrunner <unknown> (embed)
1154            - nipy <not-affected> (part of an example [/examples/neurospin/neurospy/configobj.py], which is not installed into binary packages)
1155    
1156    python-clientform
1157            - bibus <unfixed> (embed; bug #555332)
1158            - zope2.10 <unfixed> (embed; bug #555333)
1159            - zope2.11 <unfixed> (embed; bug #555334)
1160            - python-mechanize <unknown> (embed)
1161            - twill <unknown> (embed)
1162    
1163    python-mechanize
1164            - zope2.10 <unfixed> (embed; bug #555337)
1165            - zope2.11 <unfixed> (embed; bug #555338)
1166            - twill <unknown> (embed; bug #555339)
1167    
1168    pexpect
1169            - duplicity 0.6.06-1 (embed; bug #555361)
1170            - hplip <unfixed> (embed; bug #555362)
1171            - smart <unfixed> (embed; bug #555363)
1172    
1173    pyparsing
1174            - bauble <unfixed> (embed; bug #555366)
1175            - boa-constructor 0.6.1-8 (embed; bug #555367)
1176            - calibre <unfixed> (embed; bug #555368)
1177            - matplotlib <unfixed> (embed; bug #531024)
1178            - zhpy <unfixed> (embed; bug #555370)
1179            - polybori <unknown> (embed)
1180            - python-whoosh <unknown> (embed)
1181            - twill <unknown> (embed)
1182            - zope-textindexng3 <unknown> (embed)
1183    
1184    python-pysqlite2
1185            - python2.4 <unfixed> (embed; bug #553403)
1186            - python2.5 <unfixed> (embed; bug #553403)
1187    
1188    celementtree
1189            - python2.5 <unfixed> (embed)
1190            - smart 1.0-1 (embed)
1191            [etch] - smart <unfixed> (embed)
1192    
1193    elementtree
1194            - python2.5 <unfixed> (embed)
1195            - bzr <unfixed> (embed; bug #555343)
1196            - gedit 2.28.2-1 (embed; bug #555344)
1197            - smart 1.0-1 (embed)
1198            [etch] - smart <unfixed> (embed)
1199            - solfege <unfixed> (embed; bug #555345)
1200            - w3af <unfixed> (embed; bug #555346)
1201            - python-qt4 <unknown> (embed)
1202            - sphinx <unknown> (embed)
1203            - python-nltk <itp> (embed)
1204    
1205    python2.5
1206            - python2.4 <unfixed> (old-version)
1207            - jython <unfixed> (embed)
1208            NOTE: embeds many stdlib modules
1209            - python-django <unfixed> (embed; bug #555419)
1210            NOTE: embeds stdlib modules: doctest, decimal
1211            - gamera 3.2.3-1 (embed)
1212            NOTE: embeds stdlib modules: ConfigParser, optparse, sets, textwrap
1213            - boa-constructor <unfixed> (embed; bug #555426)
1214            NOTE: embeds stdlib modules: ConfigParser, tarfile, zipfile, xmlrpclib
1215            - nicotine <unfixed> (embed; bug #555427)
1216            NOTE: embeds stdlib modules: ConfigParser
1217            - museek+ <unfixed> (embed; bug #555428)
1218            NOTE: embeds stdlib modules: ConfigParser
1219            - vegastrike-data <unfixed> (embed)
1220            NOTE: embeds many stdlib modules
1221            - codespeak-lib 1.1.1-1 (embed; bug #555420)
1222            NOTE: embeds stdlib modules: doctest, optparse, subprocess, textwrap
1223            - config-manager <unfixed> (embed; bug #555423)
1224            NOTE: embeds stdlib modules: optparse
1225            - jhbuild 2.28.0-1 (embed; bug #555421)
1226            NOTE: embeds stdlib modules: optparse, subprocess
1227            - smart <unfixed> (embed; bug #555432)
1228            NOTE: embeds stdlib modules: optparse
1229            - pyprotocols 1.0a.svn20070625-5 (embed; bug #555433)
1230            NOTE: embeds stdlib modules: doctest
1231            - ruledispatch 0.5a.svn20080510-4 (embed; bug #555434)
1232            NOTE: embeds stdlib modules: doctest
1233            - distribute <unfixed> (embed)
1234            NOTE: embeds stdlib modules: doctest
1235            - python-setuptools <unfixed> (embed; bug #555435)
1236            NOTE: embeds stdlib modules: doctest
1237            - zope.testing <unfixed> (embed; bug #555436)
1238            NOTE: embeds stdlib modules: doctest
1239            - translate-toolkit <unfixed> (embed; bug #555422)
1240            NOTE: embeds stdlib modules: textwrap, contextlib
1241            - libtpclient-py <unfixed> (embed; bug #555424)
1242            NOTE: embeds stdlib modules: subprocess
1243            - grass <unfixed> (embed; bug #555425)
1244            NOTE: embeds stdlib modules: subprocess
1245            - coherence <unfixed> (embed; bug #555429)
1246            NOTE: embeds stdlib modules: uuid
1247            - python-django-extensions 0.4.2pre+git200911182050-1 (embed; bug #555430)
1248            NOTE: embeds stdlib modules: uuid
1249            - setroubleshoot <unfixed> (embed; bug #555431)
1250            NOTE: embeds stdlib modules: uuid
1251            - linkchecker <unfixed> (embed; bug #555414)
1252            NOTE: embeds msgfmt.py script
1253            - imdbpy <unfixed> (embed)
1254            NOTE: embeds msgfmt.py script
1255            - kiwi <unfixed> (embed)
1256            NOTE: embeds msgfmt.py script
1257            - moin <unfixed> (embed)
1258            NOTE: embeds msgfmt.py script, stdlib modules: cgitb, difflib, tarfile
1259            - plone3 <unfixed> (embed)
1260            NOTE: embeds msgfmt.py script
1261            - roundup <unfixed> (embed)
1262            NOTE: embeds msgfmt.py script, stdlib modules: cgitb
1263            - rednotebook <unfixed> (embed; bug #555415)
1264            NOTE: embeds msgfmt.py script
1265            - turbogears <unfixed> (embed)
1266            NOTE: embeds msgfmt.py script
1267            - elisa <unfixed> (embed)
1268            NOTE: embeds msgfmt.py script, stdlib modules: uuid
1269            - calibre <unfixed> (embed)
1270            NOTE: embeds msgfmt.py script, stdlib modules: zipfile
1271            - mailman <unfixed> (embed; #555416)
1272            NOTE: embeds msgfmt.py script
1273            - python-docutils <unknown> (embed)
1274            NOTE: embeds stdlib modules: optparse, textwrap
1275            - python-imaging <unknown> (embed)
1276            NOTE: embeds stdlib modules: doctest
1277            - python-mechanize <unknown> (embed)
1278            NOTE: embeds stdlib modules: doctest
1279            - twill <unknown> (embed)
1280            NOTE: embeds stdlib modules: subprocess
1281            - zeroc-ice <unknown> (embed)
1282            NOTE: embeds stdlib modules: subprocess
1283            - wxwidgets2.8 <unknown> (embed)
1284            NOTE: embeds stdlib modules: subprocess
1285            - cycle <unknown> (embed)
1286            NOTE: embeds msgfmt.py script
1287            - deluge <unknown> (embed)
1288            NOTE: embeds msgfmt.py script
1289            - opendict <unknown> (embed)
1290            NOTE: embeds msgfmt.py script
1291            - openerp-client <unknown> (embed)
1292            NOTE: embeds msgfmt.py script
1293            - rapidsvn <unknown> (embed)
1294            NOTE: embeds msgfmt.py script
1295            - wammu <unknown> (embed)
1296            NOTE: embeds msgfmt.py script
1297            - gaphor <unknown> (embed)
1298            NOTE: embeds msgfmt.py script
1299            - pida <unknown> (embed)
1300            NOTE: embeds msgfmt.py script
1301            - python-formencode <unknown> (embed)
1302            NOTE: embeds msgfmt.py script
1303            - duplicity <unfixed> (embed)
1304            NOTE: embeds stdlib module: urlparse, tarfile
1305            - pygopherd <unfixed> (embed)
1306            NOTE: embeds stdlib module: zipfile
1307    
1308    argparse
1309            - twill <unfixed> (embed; bug #555347)
1310            - ipython <unfixed> (embed; bug #555348)
1311    
1312    coherence
1313            - elisa <unfixed> (embed; bug #555335)
1314    
1315    simpletal
1316            - plastex <unfixed> (embed; bug #555371)
1317    
1318    flickrpc (not packaged in Debian, http://burtonini.com/bzr/flickrpc/)
1319            - postr <unfixed> (embed)
1320            - elisa <unfixed> (embed)
1321    
1322    simplegeneric (not packaged in Debian, http://pypi.python.org/pypi/simplegeneric)
1323            - apertium-tolk <unfixed> (embed)
1324            - ipython <unfixed> (embed)
1325            - virtaal <unfixed> (embed)
1326    
1327    distribute
1328            - setuptools <removed> (old-version)
1329    
1330    rails
1331            - jruby1.2 <unfixed> (embed) [./bench/rails/*]
1332            - libgettext-ruby <unfixed> (embed) [./samples/rails/*]
1333            - libopenid-ruby <unfixed> (embed) [./examples/rails_openid/*]
1334            - thin <unfixed> (embed) [./spec/rails_app/*]
1335            NOTE: this is a subdirectory of examples, which in general is a non-issue, but may
1336            NOTE: be dangerous if developers are naively basing their code off of the examples
1337            NOTE: prototype.js is among the example files
1338    
1339    lucene2 (prototype.js is among the embeds in the following)
1340            - lucene <unfixed> (old-version)
1341            - pylucene <unfixed> (embed)
1342            - libpdfbox-java <unfixed> (embed)
1343            - libfontbox-java <unfixed> (embed)
1344            - libjempbox-java <unfixed> (embed)
1345            - solr <unfixed> (embed)
1346    
1347    unicode-data
1348            - syslinux <unfixed> (embed)
1349            - camomile <unfixed> (embed)
1350            - fribidi <unfixed> (embed)
1351            - m17n-db <unfixed> (embed)
1352            - sbcl <unfixed> (embed)
1353            - heimdal <unfixed> (embed)
1354            - icu <unfixed> (embed)
1355            - icu4j <unfixed> (embed)
1356            - krb5 <unfixed> (embed)
1357            - moodle <unfixed> (embed)
1358            - openldap <unfixed> (embed)
1359            - pike7.6 <unfixed> (embed)
1360            - samba <unfixed> (embed)
1361            - samba4 <unfixed> (embed)
1362            - cmucl <unfixed> (embed)
1363            - typo3-src <unfixed> (embed)
1364            - mauve <unfixed> (embed)
1365            - texlive-bin <unfixed> (embed)
1366            - ypsilon <unfixed> (embed)
1367            - jeuclid <unfixed> (embed)
1368            - charmap.app <unfixed> (embed)
1369            - clisp <unfixed> (embed)
1370            - gnulib <unfixed> (embed)
1371            - opensrs-client <unfixed> (embed)
1372            - saxonb <unfixed> (embed)
1373            - rails <unfixed> (embed)
1374    
1375    feedparser
1376            - rawdog <unfixed> (embed; bug #383422)
1377            - miro <unfixed> (embed; bug #555351)
1378            - calibre <unfixed> (embed; bug #555352)
1379            - freevo <unfixed> (embed; bug #555353)
1380            - pida <unfixed> (embed; bug #555354)
1381            - planet-venus <unfixed> (embed; bug #555355)
1382            - plone3 <unfixed> (embed; bug #555356)
1383            - exaile 0.2.14+debian-1 (embed)
1384            - screenlets 0.1.2-3 (embed)
1385            NOTE: included twice
1386    
1387    agg:
1388            - matplotlib <unfixed> (embed: bug #377271)
1389            - contextfree <unfixed> (embed)
1390            NOTE: since 2.2-1 it links statically to system libagg, but still uses the embedded copy
1391            - exactimage <unfixed> (embed)
1392            - python-enable <unfixed> (embed)
1393            - mapnik 0.5.1-3 (embed)
1394            NOTE: links statically to agg, but shared library is not available (bug #377271)
1395    
1396    vtk
1397            - paraview <unfixable> (embed; bug #495426)
1398    
1399    txt2tags
1400            - rednotebook <unfixed> (embed)
1401    
1402    htmltextview (not packaged in Debian, http://www.gnome.org/~gjc/htmltextview.py)
1403            - gajim <unfixed> (embed)
1404            - emesene <unfixed> (embed)
1405            - convirt <unfixed> (embed)
1406            - pida <unfixed> (embed)
1407            - rednotebook <unfixed> (embed)
1408    
1409    horde3 (prototype.js is among the embeds in the following)
1410            - mnemo2 <unfixed> (embed)
1411            - nag2 <unfixed> (embed)
1412    
1413  mplayer (DirectMedia Object loader):  cimg
1414  xine-lib (src/libw32dll/)          - gmic <itp> (embed)
 vlc (modules/codec/dmo/)  
1415    
1416  libwpd (WordPerfect converter):  mootools
1417  openoffice.org          - gmic <itp> (embed)
1418    
1419  fsplib (http://sourceforge.net/projects/fsp/):  openldap
1420  gftp (lib/fsplib version 0.3)          - openldap2.3 <removed> (old-version)
1421    
1422  librpcsecgss:  grub2
1423  krb5          - grub <unfixed> (old-version)
1424    
1425  jasper:  gnupginterface
1426  ghostscript          - duplicity <unfixed> (embed)
 gs-gpl  
1427    
1428  libidn:  python-dateutil
1429  monotone          - awn-extras-applets <unfixed> (embed)
1430            - matplotlib <unknown> (embed)
1431    
1432    cups
1433            - cupsys <removed> (old-version)
1434    
1435    yui
1436            - bcfg2 <not-affected> (present in source but not included in any binary files)
1437            - serendipity <unfixed> (embed; bug #557746)
1438            - moodle 1.8.2.dfsg-5 (embed)
1439            - jifty <unfixed> (embed; bug #557748)
1440            - webgui 7.7.26-1 (embed)
1441            - loggerhead 1.17-1 (embed)
1442    
1443    quake3 (vanilla source not packaged in debian)
1444            - openarena <unfixable> (fork)
1445    
1446    quake2 (vanilla source not packaged in debian)
1447            - alien-arena <unfixable> (fork)
1448            - warsow <unfixable> (fork)
1449    
1450    libtheora
1451            - iceweasel <not-affected> (uses xulrunner)
1452            - xulrunner <unfixed> (embed; bug #540959)
1453            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1454            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1455            - iceape <unfixed> (embed; bug #559276)
1456            [etch] - iceape <not-affected> (introduced in iceape 2.0)
1457            [lenny] - iceape <not-affected> (introduced in iceape 2.0)
1458    
1459    dtoa
1460            - bfilter <unfixed> (embed)
1461            - cacao <unfixed> (embed)
1462            - cdrdao <unfixed> (embed)
1463            - classpath <unfixed> (embed)
1464            - freej <unfixed> (embed)
1465            - iceape <unfixed> (embed)
1466            - iceweasel <unfixed> (embed)
1467            - jscoverage <unfixed> (embed)
1468            - kde4libs <unfixed> (embed)
1469            - kdelibs <unfixed> (embed)
1470            - kompozer <unfixed> (embed)
1471            - libv8 <unfixed> (embed)
1472            - mono <unfixed> (embed)
1473            - newlib <unfixed> (embed)
1474            - nspr <unfixed> (embed)
1475            - php5 <unfixed> (embed)
1476            - polyml <unfixed> (embed)
1477            - qt4-x11 <unfixed> (embed)
1478            - rhino <unfixed> (embed)
1479            NOTE: code translated to Java
1480            - ruby1.8 <unfixed> (embed)
1481            - ruby1.9 <unfixed> (embed)
1482            - ruby1.9.1 <unfixed> (embed)
1483            - sdd <unfixed> (embed)
1484            - sfind <unfixed> (embed)
1485            - star <unfixed> (embed)
1486            - tinymux <unfixed> (embed)
1487            - virtualbox-ose <unfixed> (embed)
1488            - webkit <unfixed> (embed)
1489            - xulrunner <unfixed> (embed)
1490    
1491    ipc (not packaged in Debian; see http://mozdev.org/pipermail/enigmail/2009-November/011678.html)
1492            - firegpg <unfixed> (embed)
1493            - enigmail <unfixed> (embed)
1494    
1495    ptmalloc (not packaged in Debian)
1496            - crystalspace <unfixed> (embed)
1497            - qt4-x11 <unfixed> (embed)
1498    
1499    svgalib
1500            - usplash <unfixed> (embed)
1501    
1502    bogl
1503            - usplash <unfixed> (embed)
1504    
1505    taglist
1506            - usplash <unfixed> (embed)
1507    
1508    portaudio
1509            - audacity <unfixed> (embed; bug #323711)
1510    
1511    nyquist
1512            - audacity <unfixed> (embed)
1513            NOTE: embeds a forked nyquist with support for a shared library
1514    
1515  liblua:  vamp-plugin-sdk
1516  monotone          - audacity <unfixed> (embed)
1517    
1518  libbotan:  wordpress
1519  montone          - libwordpress-xmlrpc-perl <removed> (embed) [./xmlrpc.php]
1520    
1521  NetXX:  php5
1522  monotone          - php4 <removed> (old-version)
1523    
1524  libgc:  classpath
1525  mono          - libgnucrypto-java <unfixed> (embed; bug #559788)
1526    
1527  lzma:  libtool
1528  p7zip          - apr <unfixed> (static; bug #489625)
1529            NOTE: ships copy of libtool in libapr1-dev; was 'embed' before 1.3.2-3
1530            - arts <unfixed> (embed)
1531            - bochs <unfixed> (embed)
1532            - camserv <unfixed> (embed)
1533            - collectd <unfixed> (embed)
1534            - courier-authlib <unfixed> (embed)
1535            - cvsnt <unfixed> (embed)
1536            - dico <not-affected> (Uses the system copy of ltdl)
1537            - freeradius 0.1+20010527-1 (embed)
1538            NOTE: Earliest reference I could find from the changelog is from 27 May 2001
1539            - ggobi <unfixed> (embed)
1540            - glame <unfixed> (embed)
1541            - gnash <unfixed> (embed)
1542            - gnu-smalltalk <unfixed> (embed)
1543            - google-gadgets <unfixed> (embed)
1544            - graphicsmagick <unfixed> (embed)
1545            - graphviz <unfixed> (embed)
1546            - guile-1.6 <unfixed> (embed)
1547            - hamlib <unfixed> (embed)
1548            - hercules <unfixed> (embed)
1549            - jags <unfixed> (embed)
1550            - kdelibs <unfixed> (embed)
1551            - libannodex <removed> (embed)
1552            - libextractor <unfixed> (embed)
1553            - libmcrypt <unfixed> (embed)
1554            - libtunepimp <unfixed> (embed)
1555            - mp4h <unfixed> (embed)
1556            - naim <unfixed> (embed)
1557            - parser-mysql <unfixed> (embed)
1558            - pinball <unfixed> (embed)
1559            - redland <unfixed> (embed)
1560            - siproxd <unfixed> (embed)
1561            - ski <unfixed> (embed)
1562            - synfig <unfixed> (embed)
1563            - unixodbc 2.2.4-5 (embed)
1564            - xmlsec1 1.2.14-1 (embed)
1565            - clamav <unfixed> (embed)
1566            - imagemagick <unfixed> (embed)
1567            - hypre 2.4.0b-5 (embed)
1568            - lam <unfixed> (embed)
1569            - openmpi <unfixed> (embed)
1570            - parser <unfixed> (embed)
1571            - pdsh <unfixed> (embed)
1572            - sbnc 1.2-8 (embed)
1573            - sdcc <unfixed> (embed)
1574            - wml <unfixed> (embed)
1575            - proftpd-dfsg <unfixed> (embed)
1576            - babel 1.4.0.dfsg-5 (embed)
1577            - libprelude <unfixed> (embed)
1578            - heartbeat <unknown> (embed)
1579            - gcc-* <unknown> (embed)
1580    
1581  lzo:  ocamlgsl
1582  grub2          - orpie 1.5.1-7.1 (embed; bug #550058)
1583    
1584  pax code:  xdotool
1585  tar          - keynav <unfixed> (embed; bug #560103)
 cpio  

Legend:
Removed from v.7212  
changed lines
  Added in v.13523

  ViewVC Help
Powered by ViewVC 1.1.5