/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1828 by jmm-guest, Tue Sep 6 13:38:04 2005 UTC revision 12063 by derevko-guest, Sat Jun 6 22:29:35 2009 UTC
# Line 1  Line 1 
1  This file collects cases, where a source package embeds code from  Embedded code copies
2  other projects, without linking dynamically:  ====================
3    
4  xpdf code: (some use xpdf 2, some xpdf 3)  This file collects source packages that embed code from other projects.
5  gpdf  This is considered bad for fixing security flaws because the fix needs
6  pdftohtml  to be applied in multiple source packages.
7  kdegraphics/kpdf  
8  tetex-bin  Format:
9  cupsys (only older releases, recent ones use xpdf-utils, it's still present in the src, though)  <srcpkg> (<optional comment about srcpkg>)
10  poppler          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11            NOTE: optional comments about the linkage of the embedding srcpkg
12    
13    status: version number fixing the embedded copy, <unfixed>, <removed>,
14            <itp> or <unknown> if the version number can not be determined
15            <unfixable> for unavoidable cases (e.g., forks that add real value)
16    sort: static (linking statically against a lib)
17          embed (embedding a copy of the library into another source package)
18          fork (the package is not just embedding code but it is a fork and
19                thus might share parts of the source code)
20          old-version (the package is an older version of essentially
21                       the same code)
22    
23    The srcpkg might be some string to identify the code if there is no
24    specific source package.
25    
26    Everything up to the next line is ignored.
27    ---BEGIN
28    xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29            NOTE: Fixed packages link to poppler library unless otherwise noted
30            - gpdf <removed>
31            [sarge] - gpdf <unfixed>
32            NOTE: has been replaced by evince in etch
33            - pdftohtml <unknown>
34            [sarge] - pdftohtml <unfixed>
35            [etch] - pdftohtml <unfixed>
36            NOTE: has been replaced by poppler-utils
37            - kdegraphics 4:4.2.2-1 (embed; bug #436164)
38            - texlive-base 3.0-12 (embed)
39            - texlive-bin 2007-1 (embed)
40            NOTE: links to poppler
41            - koffice <unfixed> (embed; bug #436163)
42            - libextractor 0.5.12-1 (embed)
43            NOTE: libextractor is using its own pdf decoder now
44            - pdfkit.framework 0.8-4 (embed)
45            - ipe <unfixed> (embed)
46            NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
47            - ruby-gnome2 <unknown> (embed)
48            NOTE: copy only present in source but links to poppler
49            - pdfedit <unfixed> (embed; bug #510794)
50            - swftools <unfixed> (embed)
51    
52    ppmd
53            - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
54    
55    libevent
56            - transmission <unfixed> (embed; bug #529372)
57    
58    peercast
59            - gnome-peercast <unfixed> (embed)
60            NOTE: gnome-peercast may better be removed, see #466539
61    
62    silc-toolkit
63            - silc-client 1.1~beta6-1 (embed)
64    
65    icclib
66            - ghostscript <unfixed> (embed)
67            - argyll <unfixed> (embed)
68    
69    dietlibc
70            - ccontrol 0.9.1+20071204-1 (static)
71    
72    libmikmod
73            - sdl-mixer1.2 <unfixed> (embed)
74            TODO: report bug
75    
76    libiax
77            - iaxmodem <unfixed> (embed)
78    
79    zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
80            - dpkg <unfixed> (embed)
81            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
82            - rsync <unfixed> (embed)
83            NOTE: somehow derived code base
84            - mono <unfixed> (embed)
85            TODO: check mozilla
86            - Linux kernels <unfixed> (embed)
87            - pvpgn 1.7.8-2 (embed)
88            - mrtg 2.12.2-1 (embed)
89            - rpm <unknown> (embed)
90            NOTE: pinged anibal since when rpm was fixed
91            - tuxcmd-modules <unfixed> (embed)
92            - zsync <unfixed>
93            - tra <unfixed>
94            - sash <unfixed>
95            - nsis <unfixed>
96            - mseide-msegui <unfixed>
97            NOTE: mseide
98            - mirrordir <unfixed>
99            - poco <unfixed>
100            - klibc <unfixed>
101            - ghostscript <unfixed>
102            - freeimage <unfixed>
103            - clamav <unfixed> (fork)
104            NOTE: from the changelog: "libclamav6 does indeed duplicate parts of the zlib code, but there is not way around that"
105            - tuxonice-userui <unfixed>
106            - plt-scheme <unfixed>
107            - perl <unfixed>
108            - paraview <unfixed>
109            - gcvs <unfixed>
110            - erlang <unfixed>
111            - dump <unfixed>
112            - aide <unfixed> (static)
113            - dar <unfixed> (static)
114            - avfs <unfixed>
115            - fpc <unfixed>
116            - winff <unfixed>
117            NOTE: inherited from fpc, see #472304
118            - lazarus <unfixed>
119            NOTE: inherited from fpc, see #472304
120    
121    libbz2
122            - dpkg <unfixed> (static)
123    
124    libgadu:
125            - centericq <unfixed> (embed)
126            - gaim <unfixed> (embed)
127            - pidgin <unfixed> (embed)(links dynamically against libgadu) (that should be fixed, then???)
128            - kdenetwork 4:3.3.2-5 (embed)
129            NOTE: from kdenetwork: kopete
130            - gadu <unfixed> (embed)
131            - ekg 1:1.8~rc0-1 (embed)
132            - kadu 0.6.0.2-3 (embed; bug #504430)
133            NOTE: gadu not packaged in Debian yet
134    
135    xmlrpc (which package is the "origin" of this code?)
136            - drupal <unfixed> (embed)
137            - phpgroupware <unfixed> (embed)
138            - egroupware <unfixed> (embed)
139            - phpwiki <unfixed> (embed)
140            - php4 <unfixed> (embed)
141            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
142    
143    shtool (affects build-time only)
144            - mysql-ocaml <unfixed> (embed)
145            - php4 <unfixed> (embed)
146    
147    mozilla source code
148            - mozilla-firefox <unfixed> (embed)
149            - mozilla-thunderbird <unfixed>
150            - firefox <removed>
151            - thunderbird <removed>
152            - iceweasel <unfixed> (embed)
153            - iceape <unfixed> (embed)
154            - icedove <unfixed> (embed)
155            - xulrunner <unfixed> (embed)
156            - nvu <removed> (embed)
157            - kompozer <unfixed> (embed)
158    
159    xli
160            - xloadimage <unfixed> (embed)
161    
162    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
163            - openmotif <unfixed> (embed)
164            - libxpm <unfixed> (embed)
165    
166    kerberized apps with BSD origin
167            - krb4 <unfixed> (embed)
168            - krb5 <unfixed> (embed)
169            - heimdal <unfixed> (embed)
170    
171    grip (which pkg is the origin?)
172            - libcdaudio <unfixed>
173            - grip <unfixed>
174            - gnome-vfs <unfixed>
175            TODO: check vfs2 as well
176    
177    fudforum
178            [etch] - phpgroupware <unfixed> (embed)
179            NOTE: phpgroupware-fudforum
180            [sarge] - egroupware-fudforum <removed> (embed)
181    
182    cvs
183            - gcvs <unfixed> (embed)
184            NOTE: see cvsunix/src in tarball
185    
186    pcre
187            - python* <unfixed> (embed)
188            - php4 <unknown> (embed)
189            - analog 2:5.23-0woody1 (embed)
190            - goffice <unfixed> (embed)
191            NOTE: libgoffice-*
192            - vfu 4.06-4.1 (embed; bug #450754)
193            - tf5 5.0beta7-1 (embed)
194            - monotone 0.43-1 (embed)
195            NOTE: this only affects versions >= 0.37
196            - glib2.0 2.15.2-1 (embed)
197            - apache2 2.0.53-4 (embed)
198            - exim4 4.10-0.srh20.12 (embed)
199            - yacas <unfixed> (embed)
200            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
201            - gtamsanalyzer.app 0.42-5 (embed)
202            - tin <unknown> (embed)
203            - kazehakase 0.5.2-1
204            - webkit <unfixed> (embed)
205            - qt4-x11 <unfixed> (embed)
206            NOTE: embedded via webkit copy
207    
208    tiff
209            - wxwindows2.4 2.2.1 (embed)
210    
211    uudeview
212            - libconvert-uulib-perl <unfixed> (embed)
213            - pan <unfixed> (embed)
214    
215    sqlite (not affected by security vulnerabilities so far)
216            - amarok <unfixed> (embed)
217            - monotone 0.43-1 (embed)
218            - iceweasel <unfixed> (embed)
219    
220    util-linux/mount
221            - loop-aes-utils <unfixed> (embed)
222            NOTE: contains code from util-linux' mount in the mount-aes-udeb
223    
224    webmin
225            - usermin <unknown> (embed)
226            [sarge] - usermin <unfixed> (embed)
227    
228    sylpheed
229            - sylpheed-claws <unfixed> (fork)
230    
231    phpsysinfo
232            - egroupware <unfixed> (embed)
233            - phpgroupware <unfixed> (embed)
234    
235    phpldapadmin
236            [sarge] - egroupware <unfixed> (embed)
237            NOTE: removed from egroupware after sarge
238    
239    chmlib
240            - kchmviewer <unknown> (embed)
241    
242    libavcodec/libavformat (source: ffmpeg)
243            - mplayer 1.0~rc2-14 (embed; bug #395252)
244            - kino 1.0.0-1
245            - vlc <not-affected> (Links dynamically since initial release)
246            - smilutils 0.3.0-10
247            NOTE: smilutils likely fixed earlier, marking Etch's version as fixed
248            - motion 3.1.19-1
249            - gstreamer0.10-ffmpeg 0.10.3-2
250            - xmovie <unfixed>
251            TODO: gimp-gap (potentially using ffmpeg code as well)
252    
253    faad2
254            - mplayer 1.0~rc2-20 (embed)
255    
256    mad MPEG decoding lib
257            - mad <unfixed> (embed)
258            - xine-lib <unfixed> (embed)
259    
260    libdts
261            - xine-lib <unfixed> (embed)
262    
263    flac
264            - xine-lib <unfixed> (embed)
265    
266    liba52
267            - a52dec <unfixed> (embed)
268            - xine-lib <unfixed> (embed)
269    
270    libmpeg2
271            - mpeg2dec <unfixed> (embed)
272            - xine-lib <unfixed> (embed)
273    
274    curl
275            - wget <unfixed> (embed)
276            NOTE: code for NTLM authentication
277    
278    uw-imap
279            - pine <unfixed> (embed)
280            - alpine <unfixed> (embed)
281    
282    imagemagick
283            - graphicsmagick <unfixed> (fork)
284    
285    halibut
286            - nsis <unfixed> (fork)
287    
288    libghttp
289            - hotway <unfixed> (embed)
290    
291    libsndfile
292            - ardour 1:2.7.1-1 (embed)
293    
294    glibmm2.4
295            - ardour 1:2.7.1-1 (embed)
296    
297    libgnomecanvasmm2.6
298            - ardour 1:2.7.1-1 (embed)
299    
300    libsigc++-2.0
301            - ardour 1:2.7.1-1 (embed)
302    
303    soundtouch
304            - ardour 1:2.7.1-1 (embed)
305    
306    libmms
307            - xine-lib <unfixed> (embed)
308            - mimms <unfixed> (embed)
309    
310    fckeditor
311            - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
312            - moin 1.8.2-2 (embed; bug #452599)
313            - karrigell <removed> (embed; bug #452598)
314            - gforge 4.6.99+svn6225-1 (embed)
315    
316    ipatlas (not packaged in Debian)
317            - moodle <unfixed> (embed; bug #507185)
318    
319    libphp-phpmailer
320            - moodle <unfixed> (embed; bug #507185)
321            - mahara <unfixed> (embed)
322            - symfony <unfixed> (embed)
323            [etch] - phpgroupware <unfixed> (embed)
324            NOTE: phpgroupware-felamimail is only in etch
325            - egroupware <unfixed> (embed; bug #504283)
326            - glpi <unfixed>
327    
328    htmlArea (not packaged in Debian)
329            - moodle <unfixed> (embed)
330    
331    giflib:
332            - wine <unfixed> (embed; bug #466181)
333    
334    bennu (not packaged in Debian, http://bennu.sourceforge.net)
335            - moodle <unfixed> (embed)
336    
337    smarty:
338            - moodle 1.8.2-2 (embed; bug #471158)
339            - gallery2 2.2.5-2 (embed; bug #471160)
340            - mahara 0.9.2-2 (embed; bug #471201)
341            - gosa 2.4beta1-1 (embed; bug #471200)
342    
343    TinyMCE
344            - wordpress 2.5.1-3 (embed; bug #478257)
345            - moodle <unfixed> (embed; bug #507185)
346            - knowledgeroot <unfixed> (embed)
347            - joomla <itp> (bug #326398)
348    
349    scintilla (upstream provides static lib, rejected shared lib http://sf.net/support/tracker.php?aid=2488121)
350            - scite <unfixed> (embed)
351            - qscintilla <unfixed> (embed)
352            - qscintilla2 <unfixed> (embed)
353            - geany <unfixed> (fork)
354            - anjuta <unfixed> (embed)
355    
356    libphp-adodb
357            - moodle <unfixed> (embed; bug #507185)
358            NOTE: also AdoDB-XML Schema
359            - gallery2 <unfixed> (embed)
360            - phppgadmin <unfixed> (embed)
361            - egroupware <unfixed> (embed)
362            - phpwiki <unfixed> (embed)
363            - torrentflux 2.0beta1-2 (embed)
364            - ipplan <unfixed> (embed)
365            - typo3-src <unfixed> (embed)
366            - cacti <unknown> (embed)
367            [sarge] - cacti <unfixed> (embed)
368            NOTE: dependency exists, but internal version is used
369            - gforge 4.7~rc2-6 (embed)
370            - mahara <unfixed> (embed)
371    
372    gzip
373            - linux-kernel <unfixed> (embed)
374            NOTE: lib/inflate.c
375            - klibc <unfixed> (embed)
376            NOTE: based on linux-kernel gzip code
377            - busybox <unfixed> (embed)
378    
379    neon
380            - cadaver <unfixed> (embed; bug #188381)
381            - gnome-vfs2 <unfixed> (embed; bug #395874)
382            - litmus <unfixed> (embed; #395875)
383            [sarge] - screem <unfixed> (embed)
384            - sitecopy <unfixed> (embed; bug #395876)
385            [etch] - tla <unfixed> (embed; bug #395877)
386            [sarge] - tla <unfixed> (embed; bug #395877)
387    
388    libmodplug
389            - gst-plugins-bad0.10 <unfixed> (embed)
390    
391    libvncserver
392            - vino <unfixed> (embed)
393    
394    putty
395            - filezilla <unfixed> (embed)
396    
397    tinyxml (not packaged in Debian)
398            - filezilla <unfixed>
399    
400    gv
401            - evince <unfixed> (embed)
402            NOTE: ps/ tree from gv 3.5.8
403            - evince-gtk <unfixed> (embed)
404            NOTE: not packaged in Debian
405    
406    libXbae
407            [etch] - libpawlib2-lesstif <unfixed> (embed)
408            NOTE: from Cernlib
409    
410    libXaw
411            [etch] - libpawlib2-lesstif <unfixed>
412            NOTE: from Cernlib
413            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
414    
415    libgd2
416            - graphviz <unfixed> (embed)
417            NOTE: lib/gd seems to be 2.0.33
418            - wml <unfixed> (embed)
419            - libwmf <unfixed> (embed)
420            NOTE: derived from gd 1.6.3
421    
422    rar
423            - unrar-nonfree <unfixed> (embed)
424    
425    unrar-free (maybe this code is derived from the original rar, too?)
426            - clamav <unfixed> (embed)
427            NOTE: seems to be disabled in default config
428    
429    mplayer (DirectMedia Object loader)
430            - xine-lib <unfixed> (embed)
431            NOTE: src/libw32dll/
432            - vlc <unfixed> (embed)
433            NOTE: modules/codec/dmo/
434            - mplayer 1.0~rc2-20 (embed)
435    
436    libwpd (WordPerfect converter)
437            - openoffice.org <unfixed> (embed)
438    
439    fsplib (http://sourceforge.net/projects/fsp/)
440            - gftp <unfixed> (embed)
441            NOTE: lib/fsplib version 0.3
442    
443    sprng
444            - tree-puzzle <unfixed> (embed)
445    
446    librpcsecgss
447            - krb5 <unfixed> (embed)
448    
449    jasper
450            - ghostscript <unfixed> (embed)
451            - gs-gpl <unfixed> (embed)
452    
453    libiris
454            - psi <unfixed> (embed)
455            - kdenetwork <unfixed> (embed)
456            NOTE: kopete embeds libiris but links dynamically to libidn
457            - kdegames <unfixed> (embed)
458            NOTE: ksirk/kde4
459    
460    libidn
461            - monotone 0.43-1 (embed)
462            - psi <unfixed> (embed)
463            NOTE: psi embeds libiris which embeds libidn
464            - kdegames <unfixed> (embed)
465            NOTE: kdegames/kde4 embeds libiris which embeds libidn
466    
467    liblua
468            - monotone 0.43-1 (embed)
469            - nmap <unfixed> (embed; bug #527997)
470            NOTE: fixed upstream as of nmap svn rev13336.
471    
472    libbotan
473            - monotone 0.43-1 (embed)
474    
475    NetXX
476            - monotone 0.43-1 (embed)
477    
478    libgc
479            - mono <unfixed> (embed)
480    
481    lzma
482            - p7zip <unfixed> (embed)
483    
484    lzo
485            - grub2 <unfixed> (embed)
486    
487    yassl
488            - mysql-dfsg-5.0 <unfixed> (embed)
489    
490    pax code
491            - tar <unfixed> (embed)
492            - cpio <unfixed> (embed)
493    
494    t1lib
495            - tetex-bin 2.0.2-1 (embed)
496            - texlive-bin <unknown> (embed)
497    
498    guichan
499            - boswars <unfixed> (embed)
500            NOTE: maintainer notified us, working on it
501    
502    tolua
503            - boswars <unfixed> (embed)
504            NOTE: maintainer notified us, working on it
505    
506    asio-dev
507            - luxrender <unfixed> (embed)
508            NOTE: maintainer notified us, working on it
509            NOTE: may be merged with boost "soon"
510    
511    xine-lib
512            - vlc <unfixed> (embed)
513            NOTE: only parts included in modules/access/rtsp
514    
515    netpbm
516            - tcl8.3 <unfixed> (embed)
517            - tcl8.4 <unfixed> (embed)
518            - tcl8.5 <unfixed> (embed)
519            NOTE: generic/tkImgGIF.c
520    
521    tk8.5
522            - tk8.0 <removed> (old-version)
523            - tk8.3 <unfixed> (old-version)
524            - tk8.4 <unfixed> (old-version)
525            - perl-tk <unfixable> (fork)
526    
527    samba
528            - mc 2:4.6.2~git20080311-1 (embed)
529            NOTE: maintainer is aware of this, currently searching a solution
530    
531    plib1.8.4c2
532            - boson <unfixed> (fork)
533            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
534    
535    fribidi
536            - quesoglc <unfixed> (embed)
537            NOTE: compiled against system fribidi in Debian - embed only used when fribidi is not available on the system
538    
539    glew
540            - quesoglc <unfixed> (embed; bug #489341)
541            NOTE: waiting on GLEW_MX version of glew (see bug #474488)
542    
543    minorGems (pabs contacted upstream about shared lib, he considers minorGems an 'ever-evolving collection of reusable code fragments' for his own use)
544            - transcend <unfixed> (embed)
545            - cultivation <unfixed> (embed)
546            - passage <unfixed> (embed)
547            - gravitation <unfixed> (embed)
548    
549    tar
550            - libarchive <unfixed> (embed)
551            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
552    
553    cpio
554            - libarchive <unfixed> (embed)
555            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
556    
557    webkit
558            - qt4-x11 <unfixed> (embed)
559    
560    ftgl
561            - blender 2.46+dfsg-1 (embed)
562    
563    wv
564            - abiword <unfixed>
565    
566    qemu
567            - kvm <unfixed> (embed)
568            - xen-3 <unfixed> (embed)
569            - xen-unstable <unfixed> (embed)
570    
571    vgabios
572            - kvm <unfixed> (embed; bug #489442)
573    
574    bochs
575            - kvm <unfixed> (embed; bug #489442)
576    
577    speex
578            - vorbis-tools <unfixed> (embed)
579            NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
580            - gst-plugins-good0.10 <unfixed> (embed)
581            - xine-lib <unfixed> (embed)
582            - libfishsound <unfixed> (embed)
583            - libannodex <unfixed> (embed)
584            - vlc <unfixed> (embed)
585            - xmms-speex <unfixed> (embed)
586            - libsdl-sound1.2 <unfixed> (embed)
587            - sweep <unfixed> (embed)
588    
589    libreadline
590            - magic <unfixed> (old-version)
591            NOTE: magic is currently an RFS
592    
593    opcode
594            - ode <unfixed> (embed)
595            NOTE: opcode is not a package in debian, it is just embedded
596            NOTE: http://www.codercorner.com/Opcode.htm
597    
598    gimpact
599            - ode <unfixed> (embed)
600            NOTE: gimpact is not a package in debian, it is just embedded
601            NOTE: http://gimpact.sf.net
602    
603    mochikit
604            - mahara <unfixed> (embed)
605            NOTE: they require extra patches, still unmerged upstream
606            - ntop <unfixed> (embed)
607            - coherence <unfixed> (embed)
608            NOTE: python-coherence
609            - paste <unfixed> (embed)
610            NOTE: python-paste
611            - turbogears <unfixed> (embed)
612            NOTE: python-turbogears
613            - plone3 <unfixed> (embed)
614            NOTE: zope-plone3
615    
616    prototype
617            - netbeans-ide <unfixed> (embed)
618            - auth2db-frontend <unfixed> (embed)
619            - webcit <unfixed> (embed)
620            NOTE: citadel-webcit
621            - asterisk <unfixed> (embed)
622            - doc-iana <unfixed> (embed)
623            - libaws <unfixed> (embed)
624            NOTE: libaws-doc
625            - libgettext-ruby <unfixed> (embed)
626            NOTE: libgettext-ruby-data
627            - libjson-ruby <unfixed> (embed)
628            NOTE: libjson-ruby-doc
629            - lucene2 <unfixed> (embed)
630            NOTE: liblucene2-java-doc
631            - libopenid-ruby <unfixed> (embed)
632            - solr <unfixed> (embed)
633            NOTE: solr-common
634            - glpi <unfixed> (embed)
635            - hobbix <unfixed> (embed)
636            - mnemo2 <unfixed> (embed)
637            - nag2 <unfixed> (embed)
638            - knowledgeroot <unfixed> (embed)
639            - mediatomb <unfixed> (embed)
640            NOTE: mediatomb-common
641            - mt-daapd <unfixed> (embed)
642            - op-panel <unfixed> (embed)
643            - ebug-http <unfixed> (embed)
644            - phpgedview <removed> (embed)
645            - poker-network <unfixed> (embed)
646            NOTE: poker-web
647            - webhelpers <unfixed> (embed)
648            NOTE: python-webhelpers
649            - qwik <unfixed> (embed)
650            - rails <unfixed> (embed)
651            - typo3-src <unfixed> (embed)
652            - wordpress <unfixed> (embed)
653            - zope <unfixed> (embed)
654            NOTE: zope-plone3
655            - smokeping <unfixed> (embed)
656            - ampache 3.4.1-2 (embed)
657            - exaile <unfixed> (embed)
658            - hobix <unfixed> (embed)
659            - pixelpost <unfixed> (embed)
660            - symfony <unfixed> (embed)
661            NOTE: it's been said that there are custom changes
662            - zabbix <unfixed> (embed)
663            NOTE: zabbix-frontend-php
664            - turba2 <unfixed> (embed)
665    
666    gdb
667            - insight <unfixed> (embed)
668    
669    e2fsprogs
670            - ldiskfsprogs <unfixable> (fork)
671    
672    quazip (not packaged in Debian)
673            - qcake <unfixed> (embed)
674            NOTE: starting with upstream version 0.6.4
675    
676    exo
677            - pcmanfm <unfixed> (embed; bug #499677)
678            NOTE: slightly modified source code
679    
680    java
681            - openjdk-6 <unfixed>
682            - sun-java5 <unfixed>
683            - sun-java6 <unfixed>
684    
685    libphp-snoopy
686            - ampache 3.4.1-2 (embed; bug #504169)
687            - mahara 1.0.5-2 (embed; bug #504170)
688            - pixelpost <unfixed> (embed; bug #504171)
689            - mediamate 0.9.3.6-5 (embed; bug #504172)
690            - opendb <unfixed> (embed; bug #504173)
691            - wordpress 2.5.1-9 (embed; bug #443948)
692            - moodle <unfixed> (embed; bug #507185)
693            [etch] - phpgroupware <unfixed> (embed)
694            NOTE: phpgroupware-felamimail
695            - magpierss 0.72-3 (embed; bug #431089)
696    
697    jquery
698            - zekr <unfixed> (embed)
699            - wordpress <unfixed> (embed)
700            - yocto-reader <unfixed> (embed)
701            - textpattern <unfixed> (embed)
702            - genshi 0.5.1-1 (embed)
703            NOTE: compressed file under examples/ dir
704            - prewikka <unfixed> (embed)
705            - libramaze-ruby <unfixed> (embed)
706            - drupal5 <unfixed> (embed)
707            - b2evolution <unfixed> (embed)
708            - wesnoth <unfixed> (embed)
709    
710    tablesorter (jquery plugin, not packaged yet)
711            - wesnoth <unfixed> (embed)
712    
713    kses
714            - wordpress <unfixed> (embed; bug #504242)
715            NOTE: their copy has all methods renamed to wp_<foo>
716            - moodle <unfixed> (embed; bug #507185)
717            - egroupware <unfixed> (embed)
718    
719    magpierss
720            - wordpress <unfixed> (embed; bug #504242)
721            - moodle <unfixed>
722    
723    php-gettext
724            - wordpress <unfixed> (embed; bug #504242)
725    
726    libphp-ixr (name may change, it is the Incutio XML-RPC)
727            - wordpress <unfixed> (embed; bug #504242)
728            - dokuwiki <unfixed> (embed)
729            - textpattern <unfixed> (embed)
730    
731    libphp-cas
732            - glpi <unfixed> (embed)
733            - moodle <unfixed> (embed; bug #496069)
734    
735    scriptaculous
736            - glpi <unfixed> (embed)
737            - libaws <unfixed> (embed)
738            NOTE: libaws-doc
739            - op-panel <unfixed> (embed)
740            - symfony <unfixed> (embed)
741            NOTE: maintainer says there are extra incompatible changes required
742            - pixelpost <unfixed> (embed)
743            - webhelpers <unfixed> (embed)
744            NOTE: python-webhelpers
745            - qwik <unfixed> (embed)
746            - smokeping <unfixed> (embed)
747            - turba2 <unfixed> (embed)
748            - typo3-src 4.2.3-1 (embed)
749    
750    libmarkdown-php
751            - moodle <unfixed> (embed; bug #507185)
752            - pixelpost <unfixed> (embed)
753    
754    php-openid
755            - wordpress-openid <itp> (embed)
756    
757    geshi
758            - dokuwiki 0.0.20080505-3.1 (embed)
759            - pgfouine 1.0-1.1 (embed)
760            - websvn 2.1.0-1 (embed)
761    
762    webcalendar
763            - gforge-plugins-extra 4.7~rc2-6 (embed; bug #504758)
764    
765    libical
766            - kdepim <unfixed> (fork)
767            - kdepimlibs <unfixed> (fork)
768            NOTE: fixed in KDE4 post 4.1.x series
769    
770    libltdl3
771            - kdelibs <unfixed> (embed)
772            NOTE: it's been said it sets RT_GLOBAL (or something like that) at runtime and version in experimental of libltdl can optionally set it
773            - synfig <unfixed> (embed)
774    
775    harfbuzz
776            - qt4-x11 <unfixed> (embed)
777    
778    libzip
779            - php5 <unfixed> (fork)
780            - odt2txt <unfixed> (embed; bug #523808)
781    
782    json.php (not packaged; should be replaced with php's built-in functions)
783            - moodle <unfixed>
784            - yui <unfixed>
785            - gallery2 <unfixed>
786            - dokuwiki <unfixed>
787            - typo3-src <unfixed>
788    
789    php-fpdf
790            - tcpdf <itp> (fork)
791            - moodle <unfixed>
792            - phpwiki <unfixed>
793            - egroupware <unfixed>
794            - ldap-account-manager <unfixed> (fork)
795    
796    tcpdf (itp: #495985)
797            - moodle <unfixed>
798            - phpmyadmin <unfixed>
799    
800    typo3
801            - moodle <unfixed>
802    
803    spreadsheet_writeexcel (PHP port of libspreadsheet-writeexcel-perl; itp: #487557)
804            - moodle <unfixed>
805            - gosa <unfixed>
806    
807    php-ole (itp: #487558)
808            - moodle <unfixed>
809    
810    pieforms (http://www.catalyst.net.nz)
811            - mahara <unfixed>
812    
813    savant2 (http://phpsavant.com)
814            - egroupware <unfixed>
815    
816    rssparser (http://nwow.org)
817            - egroupware <unfixed>
818            - phpgroupware <unfixed>
819    
820    lcms
821            - openjdk-6 <unfixed> (fork)
822    
823    libphp-phplayersmenu
824            - diogenes <unfixed>
825            - phpldapadmin <unfixed>
826    
827    libphp-pclzip
828            - docvert <unfixed>
829            - moodle <unfixed>
830            - egroupware <unfixed>
831    
832    libphp-simplepie
833            - dokuwiki <unfixed>
834    
835    libphp-jpgraph
836            - egroupware <unfixed>
837    
838    php-simpletest
839            - moodle <unfixed>
840    
841    libpng
842            - iceweasel <unfixed> (embed)
843            NOTE: 3.0 uses embedded copy, 2.0 uses system libpng
844            - icedove: 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1, 2.0.0.19-1 (embed)
845            - iceape 1.0.13~pre080614i-0etch1 (embed)
846            - xulrunner <unfixed> (embed)
847            NOTE: Debian 1.9.0.6 uses embedded copy
848            NOTE: Ubuntu: 1.9.x use embedded copy, 1.8 and 1.8.1 use system libpng
849            - firefox 1.5.dfsg+1.5.0.3-0ubuntu3, 2.0.0.6+2nobinonly-0ubuntu1 (embed)
850            NOTE: Ubuntu only
851            - firefox-3.0 <unfixed> (embed)
852            NOTE: Ubuntu only
853            - firefox-3.1 <unfixed> (embed)
854            NOTE: Ubuntu only
855            - seamonkey 1.1.9+nobinonly-0ubuntu1 (embed)
856            NOTE: Ubuntu only
857            - thunderbird 2.0.0.6+nobinonly-0ubuntu1 (embed)
858            NOTE: Ubuntu only
859            - mozilla-thunderbird 1.5.0.2-0ubuntu2 (embed)
860            NOTE: Ubuntu only
861    
862    irssi
863            - silc-client <unfixed> (embed)
864            NOTE: Seems to be a pre-0.8.12 version that is used in irssi-plugin-silc
865    
866    extc
867            - mtasc <unfixed> (embed)
868            - haxe <unfixed> (embed)
869    
870    swflib
871            - mtasc <unfixed> (embed)
872            - haxe <unfixed> (embed)
873    
874  zlib code: (separate between 1.2 and 1.1)  libitext-java
875  dpkg          - bouncycastle 2.1.4-1 (embed)
 rsync  
 mozilla-firefox  
 mozilla(?)  
 Linux kernels  
876    
877    python-ply
878            - pyke <unfixed> (embed)
879    
880  libgadu/ekg:  libdumbnet (libdnet upstream)
881  centericq          - nmap <unfixed> (fork)
 gaim  
 kopete (ships the code, but links dynamically in the Debian package)  
 kadu (not packaged in Debian)  
 GNU gadu (not packaged in Debian)  
   
   
 xmlrpc: (which package is the "origin" of this code?)  
 drupal  
 phpgroupware  
 egroupware  
 phpwiki  
 php4 (php-pear, IIRC this was reorganized some weeks ago?)  
 tikiwiki (not packaged in Debian)  
   
   
 shtool: (affects build-time only)  
 mysql-ocaml  
 php4  
   
   
 mozilla:  
 mozilla-firefox  
 mozilla-thunderbird  
 nvu  
   
   
 xli:  
 xloadimage  
   
   
 lesstif: (beware: two different lesstif APIs supported in one package, 1.2 discarded upstream)  
 openmotif  
 xfree86/xorg (in libxpm, still the case with x.org?  
   
   
 kerberized apps with BSD origin:  
 krb4  
 krb5  
 heimdal  
   
   
 grip: (which pkg is the origin?)  
 libcdaudio  
 grip  
 gnome-vfs (vfs2 as well?)  
   
   
 fudforum:  
 phpgroupware-fudforum  
 egroupware-fudforum  
   
   
 cvs:  
 gcvs (at least an additional script is included, check if there's more)  
   
 pcre:  
 python  
 php4 (src included, but Debian package links dynamically)  
   
   
 tiff:  
 wxpythongtk (check, which debian pkg this is in)  
 older kdegraphics/kpdf releases < 3.3 embedded a copy  
   
 uudeview:  
 libconvert-uulib-perl  
   
 sqlite: (not affected by security vulnerabilities so far)  
 amarok  
   
 uudeview:  
 libconvert-uulib-perl  

Legend:
Removed from v.1828  
changed lines
  Added in v.12063

  ViewVC Help
Powered by ViewVC 1.1.5