/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1828 by jmm-guest, Tue Sep 6 13:38:04 2005 UTC revision 15825 by jmm, Mon Jan 10 17:31:36 2011 UTC
# Line 1  Line 1 
1  This file collects cases, where a source package embeds code from  Embedded code copies
2  other projects, without linking dynamically:  ====================
3    
4  xpdf code: (some use xpdf 2, some xpdf 3)  This file collects source packages that embed code from other projects.
5  gpdf  This is considered bad for fixing security flaws because the fix needs
6  pdftohtml  to be applied in multiple source packages.
7  kdegraphics/kpdf  
8  tetex-bin  Format:
9  cupsys (only older releases, recent ones use xpdf-utils, it's still present in the src, though)  <srcpkg> (<optional comment about srcpkg>)
10            - <embedding srcpkg> <status> (<sort>; bug #<number>)
11            NOTE: optional comments about the linkage of the embedding srcpkg
12    
13    status: version number fixing the embedded copy
14            <unfixed> if the issue is not yet fixed
15            <removed> if the package was removed from the archive
16            <itp> if the package is in the process of being packaged
17            <not-affected> if the package does not use the embedded copy
18            <unknown> if the version number can not be determined
19            <unfixable> for unavoidable cases (e.g., forks that add real value)
20    sort: static (linking statically against a lib)
21          embed (embeds a copy of the library into another source package)
22          modified-embed (embeds a code copy that differs from upstream code)
23          fork (a full-blown fork of another source package)
24          old-version (an older version of essentially the same code)
25    
26    The srcpkg might be some string to identify the code if there is no
27    specific source package.
28    
29    Everything up to the next line is ignored.
30    ---BEGIN
31  poppler  poppler
32            - pdftohtml <unknown>
33            [sarge] - pdftohtml <unfixed>
34            [etch] - pdftohtml <unfixed>
35            NOTE: has been replaced by poppler-utils
36            - kdegraphics 4:4.2.2-1 (embed; bug #436164)
37            - texlive-base 3.0-12 (embed)
38            - texlive-bin 2007-1 (embed)
39            - koffice 1:2.0.0-1 (embed; bug #436163)
40            - libextractor 0.5.12-1 (embed)
41            NOTE: libextractor is using its own pdf decoder now
42            - ipe <unfixed> (embed)
43            NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
44            - ruby-gnome2 <unknown> (embed)
45            - pdfedit <unfixed> (embed; bug #510794)
46            - swftools <removed> (embed; bug #551293)
47            - xpdf 3.02-9 (fork)
48    
49    pdksh (no longer developed since 1999)
50            - mksh <unfixable> (fork)
51            - posh <unfixable> (fork)
52    
53    ppmd
54            - libcomplearn-mod-ppmd <unfixed> (fork)
55            NOTE: discussion in #458152
56    
57    libevent
58            - transmission 1.71-1 (embed; bug #529372)
59            - chromium-browser 5.0.375.29~r46008-1
60            - dnsproxy <unknown> (embed)
61    
62    lrmi
63            - read-edid 2.0.0-1 (embed; bug #495131)
64            - s3switch <unfixed> (embed)
65            - xresprobe <unfixed> (embed)
66            - zhcon <unfixed> (embed)
67    
68    php-htmlpurifier
69            - mahara 1.2.5-1 (embed)
70            - knowledgeroot 0.9.9.5-5 (embed)
71            - moodle <unfixed> (embed)
72    
73    peercast
74            - gnome-peercast <removed> (embed)
75            [etch] - gnome-peercast <unfixed> (embed)
76    
77    silc-toolkit
78            - silc-client 1.1~beta6-1 (embed)
79    
80    icclib
81            - ghostscript <unfixed> (embed)
82            - argyll <unfixed> (embed)
83    
84    libusb
85            - argyll <unfixed> (embed)
86            - ia32-libs <unfixable> (embed)
87    
88    dietlibc
89            - ccontrol 0.9.1+20071204-1 (static)
90            - mksh <unfixable> (static)
91            NOTE: /bin/mksh-static only, and only on some arches (others use eglibc)
92    
93    libmikmod
94            - pysol-sound-server <unfixed> (modified-embed)
95            - sdl-mixer1.2 <unfixed> (embed)
96            TODO: report bug
97            - uqm 0.6.2.dfsg-8 (embed)
98            NOTE: Might be fixed earlier. Lenny version recorded.
99            - black-box 1.4.6-2.2 (embed)
100            NOTE: Might be fixed earlier. Lenny version recorded.
101    
102    libiax
103            - iaxmodem <unfixable> (embed; bug #548885)
104    
105    spandsp
106            - iaxmodem <unfixable> (embed; bug #548885)
107    
108    python-paramiko
109            - fabric 0.9.0-2 (embed; bug #561398)
110    
111    zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
112            - dpkg 1.15.6 (static)
113            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
114            - rsync <unfixed> (embed)
115            - cherokee <unfixed> (embed)
116            NOTE: somehow derived code base
117            - mono <unfixed> (embed)
118            TODO: check mozilla
119            - linux-2.6 <unfixed> (embed)
120            - pvpgn 1.7.8-2 (embed)
121            - mrtg 2.12.2-1 (embed)
122            - rpm <unknown> (embed)
123            NOTE: pinged anibal since when rpm was fixed
124            - tuxcmd-modules <unfixed> (embed)
125            - zsync <unfixed>
126            - tra <unfixed>
127            - sash <unfixed>
128            - nsis <unfixed>
129            - pyfits 1:2.3.1-1
130            - mseide-msegui <unfixed>
131            NOTE: mseide
132            - mirrordir <unfixed>
133            - poco <unfixed>
134            - klibc <unfixed>
135            - emboss 6.3.1-1 (embed)
136            - ghostscript 8.71~dfsg2-6 (embed)
137            NOTE: ghostscript fixed sometime before this, but this is the version i checked
138            - freeimage <unfixed>
139            - clamav <unfixed> (fork)
140            NOTE: from the changelog: "libclamav6 does indeed duplicate parts of the zlib code, but there is not way around that"
141            - tuxonice-userui <unfixed> (static)
142            - plt-scheme <unfixed>
143            - perl <unfixed>
144            - paraview <unfixed>
145            - velvet 0.7.56~nozlibcopy-1
146            - gcvs <unfixed>
147            - dump <unfixed>
148            - aide <unfixed> (static)
149            - dar <unfixed> (static)
150            - avfs <unfixed>
151            - fpc <unfixed>
152            - winff <unfixed>
153            NOTE: inherited from fpc, see #472304
154            - lazarus <unfixed>
155            NOTE: inherited from fpc, see #472304
156            - erlang <unfixed> (embed)
157            - gamera 3.2.3-1 (embed)
158            - python2.4 <unfixed> (embed; bug #553403)
159            - python2.5 <unfixed> (embed; bug #553403)
160            - texlive-bin <unknown> (embed)
161    
162    dulwich
163            - hg-git 0.1.0-1 (embed; bug #541996)
164    
165    libvigraimpex
166            - hugin <unfixed> (embed; bug #542259)
167            - enblend-enfuse <unfixed> (embed; bug #542258)
168            - gamera 3.2.3-1 (embed)
169    
170    libbz2
171            - dpkg 1.15.6 (static)
172            - amd64-libs <unfixed> (static)
173            NOTE: let's call it "static"
174            - dar <unfixed> (static)
175            - dump <unfixed> (static)
176            - unalz 0.64-1 (embed)
177            NOTE: has code, by the maint, to use the system version but links against the internal copy
178            - clamav <unfixed> (embed)
179            NOTE: libclamav/nsis/bzlib*
180            - pristine-tar <unfixable> (modified-embed)
181            NOTE: compression code only, not uncompression
182            - r-base-core-ra 1.2.8 (static)
183            - r-base-core 2.11.1 (static)
184            NOTE: links dynamically in squeeze, statically in lenny
185            - rpm <unfixed> (static)
186            NOTE: lsb-rpm package is statically linked, normal rpm links dynamically
187    
188    libyahoo2
189            - centerim <unfixed> (embed; bug #559783)
190    
191    libmsn
192            - centerim <unfixed> (embed; bug #559783)
193    
194    libgadu
195            - centerim <unfixed> (embed; bug #559783)
196            - pidgin <not-affected> (links dynamically since initial release; fixed in gaim)
197            - gaim 1:2.0.0+beta3-3 (embed; bug #360280)
198            - kdenetwork 4:3.3.2-5 (embed)
199            NOTE: from kdenetwork: kopete
200            - ekg 1:1.8~rc0-1 (embed)
201            - kadu 0.6.0.2-3 (embed; bug #504430)
202            - gadu <itp> (embed)
203    
204    xmlrpc (which package is the "origin" of this code?)
205            - drupal <unfixed> (embed)
206            - phpgroupware <unfixed> (embed)
207            - egroupware <unfixed> (embed)
208            - phpwiki <unfixed> (embed)
209            - php4 <removed> (embed)
210            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
211    
212    shtool (affects build-time only)
213            - mysql-ocaml <unfixed> (embed)
214            - php4 <removed> (embed)
215            - php5 <unfixed> (embed)
216    
217    xulrunner
218            - iceape <unfixed> (embed; bug #561749)
219            - iceweasel 2.0.0.19 (embed)
220            - icedove <unfixed> (embed; bug #561750)
221            - kompozer <unfixed> (embed; bug #532168)
222            - galeon 2.0.2-4 (embed)
223            - epiphany-browser 2.14.3-8 (embed)
224            - conkeror 0.9~git080629-2 (embed)
225            - kazehakase 0.4.2-1 (embed)
226    
227    xli
228            - xloadimage <unfixed> (embed)
229    
230    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
231            - openmotif <unfixed> (embed)
232    
233    libxpm
234            - lesstif2 <unfixed> (embed; bug #575750)
235            - ia32-libs <unfixable> (embed)
236    
237    kerberized apps with BSD origin
238            - krb4 <removed> (embed)
239            - krb5 <unfixed> (embed)
240            - heimdal <unfixed> (embed)
241    
242    grip (which pkg is the origin?)
243            - libcdaudio <unfixed>
244            - grip <unfixed>
245            - gnome-vfs <unfixed>
246            TODO: check vfs2 as well
247    
248    fudforum
249            [etch] - phpgroupware <unfixed> (embed)
250            NOTE: phpgroupware-fudforum
251            [sarge] - egroupware-fudforum <removed> (embed)
252    
253    libbsd
254            - rdate 1:1.2-3 (embed)
255            - atheme-services <unfixed>
256            - libbsd-arc4random-perl <not-affected> (modified-embed)
257            NOTE: code not used, it links dynamically against libbsd instead
258            - isakmpd <unfixed>
259            - bsdgames <unfixed> (embed)
260            - bsd-mailx <unfixed> (embed)
261            - netcat-openbsd <unfixed> (embed; bug #550611)
262            - openssh <unfixed> (embed)
263            - unworkable <unfixed> (embed)
264            - mksh <unfixed> (modified-embed)
265            NOTE: strlcpy(), only used in /bin/mksh-static on eglibc arches
266            NOTE: FIXME, we should only have one entry: - mksh <not-affected> (modified-embed)
267            NOTE: strlcpy() on dietlibc arches; {g,s}etmode(); both unused
268            - ia32-libs <unfixable> (embed)
269    
270    cvs
271            - gcvs <unfixed> (embed)
272            NOTE: see cvsunix/src in tarball
273    
274    pcre3
275            - php4 <removed> (embed)
276            - analog 2:5.23-0woody1 (embed)
277            - chicken 3.2.7-2 (embed)
278            NOTE: Might be fixed earlier. Lenny version recorded.
279            - goffice <unfixed> (embed)
280            NOTE: libgoffice-*
281            - hypermail 2.2.0.dfsg-2 (embed)
282            NOTE: Might be fixed earlier. Lenny version recorded.
283            - privoxy 3.0.9-1 (embed)
284            NOTE: Might be fixed earlier. Lenny version recorded.
285            - vfu 4.06-4.1 (embed; bug #450754)
286            - tf5 5.0beta7-1 (embed)
287            - monotone 0.43-1 (embed)
288            NOTE: this only affects versions >= 0.37
289            - glib2.0 2.15.2-1 (embed)
290            - apache2 2.0.53-4 (embed)
291            - exim4 4.10-0.srh20.12 (embed)
292            - yacas <unfixed> (embed)
293            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
294            - gtamsanalyzer.app 0.42-5 (embed)
295            - tin 980117-1 (embed)
296            - kazehakase 0.5.2-1
297            - webkit 1.0.1-1 (embed)
298            - qt4-x11 <unfixed> (embed)
299            NOTE: embedded via webkit copy
300            - erlang <unfixed> (embed)
301            - ssed <unfixed> (embed)
302            - ircd-hybrid <unfixed> (static)
303            - emboss <unfixed> (fork)
304            - cherokee <unfixed> (embed)
305            - oftc-hybrid 1.6.9.dfsg-1 (embed)
306            - ratbox-services <unfixed> (embed)
307            - squeak-vm <unfixed> (embed)
308            - tinymux <unfixed> (embed)
309    
310    tiff
311            - wxwindows2.4 2.2.1 (embed)
312            - gamera 3.2.3-1 (embed)
313            - freeimage <unfixed> (embed)
314            - libtk-img <unfixed> (embed)
315            NOTE: there are two copies, one under tiff/ other under libtiff/
316            - gdal <unfixed>
317            - ia32-libs <unfixable> (embed)
318    
319    uudeview
320            - libconvert-uulib-perl <unfixed> (embed)
321            - pan <unfixed> (embed)
322    
323    sqlite (not affected by security vulnerabilities so far)
324            - amarok <unfixed> (embed)
325            - monotone 0.43-1 (embed)
326            - iceweasel <unfixed> (embed)
327            - heimdal <unfixed> (embed; bug #559616)
328    
329    util-linux
330            - loop-aes-utils <unfixed> (embed)
331            NOTE: contains code from util-linux' mount in the mount-aes-udeb
332            - ia32-libs <unfixable> (embed)
333    
334    sylpheed
335            - sylpheed-claws <unfixed> (fork)
336    
337    phpsysinfo
338            - egroupware <unfixed> (embed)
339            - phpgroupware <unfixed> (embed)
340    
341    phpldapadmin
342            [sarge] - egroupware <unfixed> (embed)
343            NOTE: removed from egroupware after sarge
344    
345    chmlib
346            - kchmviewer <unknown> (embed)
347    
348    ffmpeg (libavcodec/libavformat)
349            - mplayer 1.0~rc2-14 (embed; bug #395252)
350            - kino 1.0.0-1
351            - vlc <not-affected> (Links dynamically since initial release)
352            - smilutils 0.3.0-10
353            NOTE: smilutils likely fixed earlier, marking Etch's version as fixed
354            - motion 3.1.19-1
355            - gstreamer0.10-ffmpeg 0.10.3-2
356            - xmovie <removed> (static)
357            TODO: gimp-gap (potentially using ffmpeg code as well)
358            - avifile 1:0.7.48~20090503.ds-1 (embed; bug #538750)
359            - audacity 1.3.7-2 (embed; bug #512278)
360            - chromium-browser <unfixed> (fork)
361    
362    faad2
363            - mplayer 1.0~rc2-20 (embed)
364            - avifile <unfixed> (embed; bug #538750)
365            - ffmpeg-debian <removed> (embed)
366    
367    libmad (MPEG decoding lib)
368            - xine-lib <unfixed> (embed)
369            - avifile 1:0.7.48~20090503.ds-1 (embed) [./plugins/libmad/*]
370            TODO: check ocaml-mad, madplay, pymad, xmms-mad, xmms2
371    
372    libdts
373            - xine-lib <unfixed> (embed)
374    
375    flac
376            - xine-lib <unfixed> (embed)
377            - ia32-libs <unfixable> (embed)
378    
379    liba52
380            - a52dec <unfixed> (embed)
381            - xine-lib <unfixed> (embed)
382    
383    mpeg2dec (libmpeg2)
384            - xine-lib <unfixed> (embed)
385    
386    libmpeg3
387            - squeak-vm <unfixed> (embed)
388    
389    libntlm
390            - wget <unfixed> (fork; bug #550436)
391            - curl <unfixed> (fork; bug #550437)
392            - cntlm <unfixed> (fork; bug #550438)
393    
394    uw-imap
395            - pine <unfixed> (embed)
396            - alpine <unfixed> (embed)
397    
398    imagemagick
399            - graphicsmagick <unfixed> (fork)
400    
401    python-urlgrabber
402            - mercurial <unfixed> (embed; bug #531062)
403            - w3af <unfixed> (embed; bug #555372)
404            [experimental] - harvestman <unfixed> (embed; bug #555373)
405    
406    beautifulsoup
407            - python-mechanize <unfixed> (embed; bug #555349)
408            - zope2.11 <removed> (embed; bug #555350)
409            - twill <unknown> (embed)
410    
411    halibut
412            - nsis <unfixed> (fork)
413    
414    libghttp
415            - hotway <unfixed> (embed)
416    
417    libsndfile
418            - ardour 1:2.7.1-1 (embed)
419            - ia32-libs <unfixable> (embed)
420    
421    glibmm2.4
422            - ardour 1:2.7.1-1 (embed)
423    
424    libgnomecanvasmm2.6
425            - ardour 1:2.7.1-1 (embed)
426    
427    libsigc++-2.0
428            - ardour 1:2.7.1-1 (embed)
429            - ia32-libs <unfixable> (embed)
430    
431    soundtouch
432            - ardour 1:2.7.1-1 (embed)
433    
434    libmms
435            - xine-lib <unfixed> (embed)
436            - mimms <unfixed> (embed)
437    
438    fckeditor
439            - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
440            - moin 1.8.2-2 (embed; bug #452599)
441            - karrigell <removed> (embed; bug #452598)
442            - gforge 4.6.99+svn6225-1 (embed)
443            - request-tracker3.8 <unfixed> (embed)
444            - otrs2 <unfixed> (embed)
445    
446    ipatlas (not packaged in Debian)
447            - moodle <unfixed> (embed; bug #507185)
448    
449    libphp-phpmailer
450            - moodle <unfixed> (embed; bug #507185)
451            - mahara <unfixed> (embed)
452            - symfony <unfixed> (embed; bug #566778)
453            [etch] - phpgroupware <unfixed> (embed)
454            NOTE: phpgroupware-felamimail is only in etch
455            - egroupware <unfixed> (embed; bug #504283)
456            - glpi <unfixed>
457    
458    htmlArea (not packaged in Debian)
459            - moodle <unfixed> (embed)
460    
461    giflib
462            - wine <unfixed> (embed; bug #466181)
463    
464    bennu (not packaged in Debian, http://bennu.sourceforge.net)
465            - moodle <unfixed> (embed)
466    
467    smarty
468            - moodle 1.8.2-2 (embed; bug #471158)
469            - gallery2 2.2.5-2 (embed; bug #471160)
470            - mahara 0.9.2-2 (embed; bug #471201)
471            - gosa 2.4beta1-1 (embed; bug #471200)
472    
473    TinyMCE
474            - wordpress 2.5.1-3 (embed; bug #478257)
475            - moodle <unfixed> (embed; bug #507185)
476            - knowledgeroot <unfixed> (embed)
477            - joomla <itp> (bug #326398)
478            - mahara 1.2.6-1 (embed; #597752)
479    
480    scintilla (upstream provides static lib, rejected shared lib http://sf.net/support/tracker.php?aid=2488121)
481            - scite <unfixed> (embed)
482            - qscintilla <unfixed> (embed)
483            - qscintilla2 <unfixed> (embed)
484            - geany <unfixed> (fork)
485            - anjuta <unfixed> (embed)
486    
487    libphp-adodb
488            - moodle <unfixed> (embed; bug #507185)
489            NOTE: also AdoDB-XML Schema
490            - gallery2 <unfixed> (embed)
491            - phppgadmin <unfixed> (embed)
492            - egroupware <unfixed> (embed)
493            - phpwiki <unfixed> (embed)
494            - torrentflux 2.0beta1-2 (embed)
495            - ipplan <unfixed> (embed)
496            - typo3-src <unfixed> (embed)
497            - cacti <unknown> (embed)
498            [sarge] - cacti <unfixed> (embed)
499            NOTE: dependency exists, but internal version is used
500            - gforge 4.7~rc2-6 (embed)
501            - mahara <unfixed> (embed)
502    
503    gzip
504            - linux-2.6 <unfixed> (embed) [lib/inflate.c]
505            - klibc <unfixed> (embed)
506            NOTE: based on linux-kernel gzip code
507            - busybox <unfixed> (embed)
508            - pristine-tar <unfixed> (modified-embed)
509            NOTE: compression code only, not uncompression
510            - ncompress <unfixed> (old-version)
511    
512    neon
513            - cadaver 0.22.3+debian-1 (embed; bug #188381)
514            - gnome-vfs2 <unfixed> (embed; bug #395874)
515            [etch] - litmus <unfixed> (embed; #395875)
516            - litmus <removed> (embed; #395875)
517            [sarge] - screem <unfixed> (embed)
518            - sitecopy 1:0.16.0-1 (embed; bug #395876)
519            [etch] - tla <unfixed> (embed; bug #395877)
520            [sarge] - tla <unfixed> (embed; bug #395877)
521    
522    libmodplug
523            - gst-plugins-bad0.10 0.10.10.2-1 (embed)
524    
525    libvncserver
526            - vino <unfixed> (embed)
527    
528    putty
529            - filezilla <unfixed> (embed)
530    
531    tinyxml (not packaged in Debian; itp bug #531968)
532            - filezilla <unfixed>
533            - crystalspace <unfixed> (embed)
534            - libwfut <unfixed> (embed)
535            - rarian <unfixed> (embed)
536            - bulletml <unfixed> (embed)
537            - pokerth <unfixed> (embed)
538            - qutecom <unfixed> (embed)
539            - sofa-framework <unfixed> (embed)
540            - yate <unfixed> (embed)
541            - antigrav <unfixed> (embed)
542            - balder2d <unfixed> (embed)
543            - cal3d <unfixed> (embed)
544            - criticalmass <unfixed> (embed)
545            - ember <unfixed> (embed)
546            - epiphany <unfixed> (embed)
547            - gambit <unfixed> (embed)
548            - noiz2sa <unfixed> (embed)
549            - ogre <unfixed> (embed)
550            - opencity <unfixed> (embed)
551            - openmovieeditor <unfixed> (embed)
552            - pouetchess <unfixed> (embed)
553            - tecnoballz <unfixed> (embed)
554            - trigger-rally <unfixed> (embed)
555            - xmoto <unfixed> (embed)
556            - mapnik <unknown> (embed)
557            NOTE: uses a different XML parser by default
558            - rrootage 0.23a-6 <embed>
559            NOTE: links to libbulltetml
560            - boson <unknown> (embed)
561            NOTE: the embedded code is unused
562    
563    gv
564            - evince <unfixed> (embed)
565            NOTE: ps/ tree from gv 3.5.8
566            NOTE: evince-gtk is affected (a component of evince source package)
567    
568    libXbae
569            - paw <unfixed> (embed)
570    
571    libgtkhtml
572            - claws-mail-extra-plugins <unfixed> (fork)
573    
574    libXaw
575            - paw <unfixed> (embed)
576            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
577            - ia32-libs <unfixable> (embed)
578    
579    libgd2
580            - graphviz <unfixed> (embed)
581            NOTE: lib/gd seems to be 2.0.33
582            - wml 2.0.11ds2-1 (embed)
583            - libwmf <unfixed> (embed)
584            NOTE: derived from gd 1.6.3, but only used to write images
585            - plt-scheme <unfixed> (embed; bug #601525)
586            - texlive-bin 2009-1 (embed)
587    
588    rar
589            - unrar-nonfree <unfixed> (embed)
590    
591    unrar-free (maybe this code is derived from the original rar, too?)
592            - clamav <unfixed> (embed)
593            NOTE: seems to be disabled in default config
594    
595    mplayer (DirectMedia Object loader)
596            - xine-lib <unfixed> (embed)
597            NOTE: src/libw32dll/
598            - vlc <unfixed> (embed)
599            NOTE: modules/codec/dmo/
600            - mplayer 1.0~rc2-20 (embed)
601    
602    libwpd (WordPerfect converter)
603            - openoffice.org <unfixed> (embed)
604    
605    fsplib (http://sourceforge.net/projects/fsp/)
606            - gftp <unfixed> (embed)
607            NOTE: lib/fsplib version 0.3
608    
609    sprng
610            - tree-puzzle <unfixed> (embed)
611    
612    librpcsecgss
613            - krb5 <unfixed> (embed)
614    
615    jasper
616            - ghostscript 8.64~dfsg-2 (embed)
617    
618    libiris
619            - psi <unfixed> (embed)
620            - kdenetwork <unfixed> (embed)
621            NOTE: kopete embeds libiris but links dynamically to libidn
622            - kdegames <unfixed> (embed)
623            NOTE: ksirk/kde4
624    
625    libidn
626            - monotone 0.43-1 (embed)
627            - psi <unfixed> (embed)
628            NOTE: psi embeds libiris which embeds libidn
629            - kdegames <unfixed> (embed)
630            NOTE: kdegames/kde4 embeds libiris which embeds libidn
631            - ia32-libs <unfixable> (embed)
632    
633    lua5.1
634            - monotone 0.43-1 (embed)
635            - nmap 5.00-1 (embed; bug #527997)
636            [lenny] - nmap <unfixed> (embed; bug #527997)
637            - ocropus <unfixed> (embed)
638            - enigma <unfixed> (embed)
639            NOTE: requires lua built with C++
640            - freeciv <unfixed> (embed)
641            - spring <unfixed> (embed)
642    
643    libbotan
644            - monotone 0.43-1 (embed)
645    
646    NetXX
647            - monotone 0.43-1 (embed)
648    
649    libgc
650            - mono <unfixed> (embed)
651    
652    lzma
653            - p7zip <unfixed> (embed)
654            - xz-utils <unfixed> (fork)
655            - r-base <unfixed> (embed)
656            NOTE: lzma support not yet in lenny or in r-base-core-ra 1.2.8
657    
658    lzo
659            - grub2 <unfixed> (embed)
660    
661    yassl
662            - mysql-dfsg-5.0 <unfixed> (embed)
663            - mysql-5.1 <unfixed> (embed)
664    
665    pax code
666            - tar <unfixed> (embed)
667            - cpio <unfixed> (embed)
668    
669    t1lib
670            - tetex-bin 2.0.2-1 (embed)
671            - texlive-bin <unknown> (embed)
672            - grace 5.1.14-2 (embed)
673            NOTE: Might be fixed even earlier
674    
675    guichan
676            - boswars <unfixed> (embed)
677            NOTE: maintainer notified us, working on it
678    
679    tolua
680            - boswars <unfixed> (embed)
681            NOTE: maintainer notified us, working on it
682            NOTE: actually tolua++
683            - ocropus <unfixed> (embed)
684            NOTE: actually tolua++
685            - freeciv <unfixed> (embed)
686            NOTE: actually tolua++
687            - enigma <unfixed> (embed)
688    
689    asio-dev
690            - luxrender <removed> (embed)
691    
692    xine-lib
693            - vlc <unfixed> (embed)
694            NOTE: only parts included in modules/access/rtsp
695    
696    netpbm
697            - tcl8.3 <unfixed> (embed)
698            - tcl8.4 <unfixed> (embed)
699            - tcl8.5 <unfixed> (embed)
700            NOTE: generic/tkImgGIF.c
701    
702    tk8.5
703            - tk8.0 <removed> (old-version)
704            - tk8.3 <unfixed> (old-version)
705            - tk8.4 <unfixed> (old-version)
706            - perl-tk <unfixable> (fork)
707    
708    samba
709            - mc 2:4.6.2~git20080311-1 (embed)
710            NOTE: maintainer is aware of this, currently searching a solution
711    
712    plib1.8.4c2
713            - boson <unfixed> (fork)
714            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
715    
716    fribidi
717            - quesoglc 0.7.2-2 (embed)
718    
719    glew
720            - quesoglc <unfixed> (embed; bug #489341)
721            NOTE: waiting on GLEW_MX version of glew (see bug #474488)
722            - trigger 0.5.2.1-2 (embed)
723            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
724            - trigger-rally 0.5.2.1-2 (embed)
725            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
726            - chromium-browser 5.0.375.70~r48679-2
727    
728    minorGems (pabs contacted upstream about shared lib, he considers minorGems an 'ever-evolving collection of reusable code fragments' for his own use)
729            - transcend <unfixed> (embed)
730            - cultivation <unfixed> (embed)
731            - passage <unfixed> (embed)
732            - gravitation <unfixed> (embed)
733    
734    tar
735            - libarchive <unfixed> (embed)
736            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
737    
738    cpio
739            - libarchive <unfixed> (embed)
740            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
741    
742    kde4libs
743            - kdelibs <unfixable> (old-version)
744    
745    webkit
746            - qt4-x11 <unfixed> (embed; bug #479851)
747            [etch] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
748            - kde4libs <unfixable> (fork)
749            NOTE: kde4lib's khtml and webkit were forked from khtml (this tracking, which seems
750            NOTE: reversed genesis-wise, is used because of so much other stuff in kde4libs)
751            - chromium-browser <unfixed> (fork)
752    
753    ftgl
754            - blender 2.46+dfsg-1 (embed)
755    
756    wv
757            - abiword <unfixed>
758    
759    qemu
760            - kvm <removed> (embed; bug #543159)
761            - qemu-kvm <unfixed> (embed; bug #560853)
762            NOTE: kvm superceded by qemu-kvm, which is just user interface (no modules)
763            - xen-3 3.4.2-2 (embed; bug #560856)
764            - xen-unstable <unfixed> (embed; bug #560856)
765    
766    vgabios
767            - kvm <removed> (embed; bug #489442)
768            - qemu-kvm <unfixed> (embed)
769    
770    bochs
771            - kvm <removed> (embed; bug #489442)
772            - qemu-kvm <unfixed> (embed)
773    
774    speex
775            - vorbis-tools <unfixed> (embed)
776            NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
777            - gst-plugins-good0.10 <unfixed> (embed)
778            - xine-lib <unfixed> (embed)
779            - libfishsound <unfixed> (embed)
780            - libannodex <removed> (embed)
781            - opal 3.4.2~dfsg-2 (embed)
782            - mumble 1.2.0~beta1-1 (embed)
783            - vlc <unfixed> (embed)
784            - xmms-speex <unfixed> (embed)
785            - libsdl-sound1.2 <unfixed> (embed)
786            - sweep <unfixed> (embed)
787    
788    libreadline
789            - magic <itp> (old-version)
790    
791    opcode
792            - ode <unfixed> (embed)
793            NOTE: opcode is not a package in debian, it is just embedded
794            NOTE: http://www.codercorner.com/Opcode.htm
795    
796    gimpact
797            - ode <unfixed> (embed)
798            NOTE: gimpact is not a package in debian, it is just embedded
799            NOTE: http://gimpact.sf.net
800    
801    mochikit
802            - mahara <unfixed> (embed)
803            NOTE: they require extra patches, still unmerged upstream
804            - ntop <unfixed> (embed)
805            - coherence 0.6.2-1 (embed)
806            - paste <unfixed> (embed)
807            - turbogears <unfixed> (embed)
808            - plone3 <removed> (embed)
809            - xulrunner <unfixed> (embed)
810            - libjifty-plugin-chart-perl <unfixed> (embed)
811            - sabnzbdplus <unfixed> (embed)
812            - tgmochikit <unfixed> (embed)
813    
814    prototypejs
815            - netbeans-ide 6.0.1+dfsg-2 (embed)
816            - auth2db 0.2.5-2+dfsg-1 (embed; bug #555218)
817            - webcit <unfixed> (embed; bug #555219)
818            - asterisk 1:1.6.2.0~rc3-1 (embed)
819            - libjson-ruby 1.1.4-1 (embed; bug #555224)
820            - lucene2 2.9.1+ds1-2 (embed; bug #555226)
821            - horde3 <unfixed> (embed)
822            - knowledgeroot 0.9.8.5-4 (embed; bug #555230)
823            - mediatomb 0.12.0~svn2018-5 (embed; bug #555233)
824            - mt-daapd 0.9~r1696.dfsg-6lenny2 (embed)
825            - ebug-http <unfixed> (embed; bug #555236)
826            - libaws 2.7-1 (embed; bug #555222)
827            - phpgedview <removed> (embed)
828            - poker-network 1.7.6-1 (embed; bug #555238)
829            - rails 2.1.0-6 (embed)
830            - wordpress 2.5.0-2 (embed; bug #555243)
831            - zope <not-affected> (the prototypejs embed is not in any of the obvious zope packages, e.g. zope2.9, zope2.10, zope2.11, and zope3)
832            TODO: search through all of the other zope packages
833            - ampache 3.4.1-2 (embed)
834            - exaile 0.2.14+debian-2.1 (embed; bug #555245)
835            - hobix 0.5~svn20070319-4 (embed; bug #555247)
836            - zabbix 1.6.6-4 (embed; bug #555250)
837            - chora2 2.1.1+debian0-1 (embed; bug #555253)
838            - gollem 1.1.1+debian0-1 (embed; bug # 555254)
839            - jscropperui 1.2.1-1 (embed; bug #555257)
840            - scriptaculous <not-affected> (uses system prototype.js since initial upload; bug #555260)
841            - ingo1 1.2.3+debian0-1 (embed; bug #555261)
842            - kronolith2 2.3.3+debian0-1 (embed; bug #555262)
843            - activeldap 1.2.1-1 (embed)
844            - libv8 <not-affected> (contains a google-specific implementation of prototype.js)
845            - mantis 1.1.2+dfsg-1 (embed; bug #555265)
846            - otrs2 2.3.4-6 (embed; bug #555267)
847            - webcalendar 1.2~b1-2 (embed; bug #555269)
848            - redmine 0.9.0~svn2907-1 (embed; bug #555270)
849            - jifty 0.90519-1 (embed; bug #555271)
850            - jquery 1.4-1 (embed; bug #555272)
851            - passenger 2.2.5debian1-1 (embed; bug #555273)
852            - plone3 <removed> (embed; bug #555275)
853            - wesnoth <not-affected> (prototype.js not included in any of the binary packages; bug #555277)
854            - libhtml-prototype-perl 1.48-3 (embed; bug #538920)
855            - xulrunner <unfixed> (embed)
856            NOTE: included in iceweasel/xulrunner unit tests directory, so may not be security-relevant
857            - jclicmoodle <unfixed> (embed)
858            - git-cola <unfixed> (embed)
859    
860    gdb
861            - insight <unfixed> (embed)
862    
863    e2fsprogs
864            - ldiskfsprogs <unfixable> (fork)
865            - ia32-libs <unfixable> (embed)
866    
867    quazip (not packaged in Debian)
868            - qcake <unfixed> (embed)
869            NOTE: starting with upstream version 0.6.4
870    
871    exo
872            - pcmanfm <unfixed> (embed; bug #499677)
873            NOTE: slightly modified source code
874    
875    java
876            - openjdk-6 <unfixed>
877            - sun-java5 <unfixed>
878            - sun-java6 <unfixed>
879    
880    libphp-snoopy
881            - ampache 3.4.1-2 (embed; bug #504169)
882            - gforge 4.6.99+svn6094-2 (embed)
883            - mahara 1.0.5-2 (embed; bug #504170)
884            - pixelpost 1.7.1-5 (embed; bug #504171)
885            - mediamate 0.9.3.6-5 (embed; bug #504172)
886            - opendb <removed> (embed; bug #504173)
887            [etch] - opendb <unfixed> (embed; bug #504173)
888            - wordpress 2.5.1-9 (embed; bug #443948)
889            - moodle <unfixed> (embed; bug #507185)
890            [etch] - phpgroupware <unfixed> (embed)
891            NOTE: phpgroupware-felamimail
892            - magpierss 0.72-3 (embed; bug #431089)
893    
894    jquery
895            - zekr <unfixed> (embed)
896            - wordpress <unknown> (embed)
897            - yocto-reader <unfixed> (embed)
898            - textpattern <unfixed> (embed)
899            - genshi 0.5.1-1 (embed)
900            NOTE: compressed file under examples/ dir
901            - prewikka <unfixed> (embed)
902            - libramaze-ruby <unfixed> (embed)
903            - drupal6 <unfixed> (embed)
904            - b2evolution <unfixed> (embed)
905            - wesnoth <unfixed> (embed)
906            - gammu 1.28.95-1 (embed)
907    
908    tablesorter (jquery plugin, not packaged yet)
909            - wesnoth <unfixed> (embed)
910    
911    kses
912            - wordpress <unfixed> (embed; bug #504242)
913            NOTE: their copy has all methods renamed to wp_<foo>
914            NOTE: kses isn't in Debian, RFP: #504240
915            - moodle <unfixed> (embed; bug #507185)
916            - egroupware <unfixed> (embed)
917    
918    magpierss
919            - wordpress <unfixed> (embed; bug #504242)
920            - moodle <unfixed>
921    
922    php-gettext
923            - wordpress 2.8.4-1 (embed; bug #504242)
924            - docbookwiki <unfixed> (embed)
925            - knowledgeroot 0.9.9.5-1
926            NOTE: non-free
927    
928    libphp-ixr (name may change, it is the Incutio XML-RPC)
929            - wordpress <unfixed> (embed; bug #504242)
930            NOTE: libphp-ixr isn't in Debian, RFP: #504236
931            - dokuwiki <unfixed> (embed)
932            - textpattern <unfixed> (embed)
933    
934    libphp-cas
935            - glpi <unfixed> (embed)
936            - moodle <unfixed> (embed; bug #505984)
937    
938    scriptaculous (prototype.js is among the embeds in the following)
939            - glpi <unfixed> (embed)
940            - libaws <unfixed> (embed; bug #555222)
941            - op-panel <unfixed> (embed)
942            - symfony <unfixed> (embed)
943            NOTE: maintainer says there are extra incompatible changes required
944            - pixelpost 1.7.1-6 (embed)
945            - webhelpers <unfixed> (embed)
946            - qwik <removed> (embed; bug #555241)
947            - smokeping <unfixed> (embed)
948            - turba2 <unfixed> (embed)
949            - typo3-src 4.2.3-1 (embed)
950            - request-tracker3.6 <unfixed> (embed)
951            - request-tracker3.8 <unfixed> (embed)
952            - rt-extension-emailcompletion <not-affected> (prototype.js not included in the binary package)
953            - wordpress 2.5.0-2 (embed)
954            - libhtml-prototype-perl 1.48-3 (embed)
955    
956    libmarkdown-php
957            - moodle <unfixed> (embed; bug #507185)
958            - pixelpost 1.7.1-6 (embed)
959    
960    php-openid
961            - wordpress-openid 3.3.2-1 (embed)
962    
963    geshi
964            - dokuwiki 0.0.20080505-3.1 (embed)
965            - pgfouine 1.0-1.1 (embed)
966            - websvn 2.1.0-1 (embed)
967    
968    webcalendar
969            - gforge 4.7~rc2-6 (embed; bug #504758)
970    
971    libical
972            - kdepim <unknown> (fork)
973            NOTE: fixed at some point during 4.0
974            - kdepimlibs 4.2.0-1 (fork)
975            - claws-mail-extra-plugins <unfixed> (fork)
976    
977    harfbuzz
978            - qt4-x11 <unfixed> (embed)
979            - pango1.0 <unfixed> (embed)
980            - fontmatrix <unfixed> (embed)
981    
982    libzip
983            - php5 <unfixable> (modified-embed)
984            - odt2txt <unfixed> (embed; bug #523808)
985    
986    json.php (not packaged; should be replaced with php's built-in functions)
987            - moodle <unfixed>
988            - yui <unfixed>
989            - gallery2 <unfixed>
990            - dokuwiki <unfixed>
991            - typo3-src <unfixed>
992    
993    php-fpdf
994            - tcpdf <itp> (fork)
995            - moodle <unfixed>
996            - phpwiki <unfixed>
997            - egroupware <unfixed>
998            - ldap-account-manager <unfixed> (fork)
999    
1000    tcpdf (itp: #495985)
1001            - moodle <unfixed>
1002            - phpmyadmin <unfixed>
1003    
1004    typo3
1005            - moodle <unfixed>
1006    
1007    spreadsheet_writeexcel (PHP port of libspreadsheet-writeexcel-perl; itp: #487557)
1008            - moodle <unfixed>
1009            - gosa <unfixed>
1010    
1011    php-ole (itp: #487558)
1012            - moodle <unfixed>
1013    
1014    pieforms (http://www.catalyst.net.nz)
1015            - mahara <unfixed>
1016    
1017    savant2 (http://phpsavant.com)
1018            - egroupware <unfixed>
1019    
1020    rssparser (http://nwow.org)
1021            - egroupware <unfixed>
1022            - phpgroupware <unfixed>
1023    
1024    lcms
1025            - openjdk-6 <unfixed> (fork)
1026            - gimp 2.4.0~rc2-2
1027            - ia32-libs <unfixable> (embed)
1028    
1029    libphp-phplayersmenu
1030            - diogenes <unfixed>
1031            - phpldapadmin <unfixed>
1032    
1033    libphp-pclzip
1034            - docvert <unfixed>
1035            - moodle <unfixed>
1036            - egroupware <unfixed>
1037    
1038    libphp-simplepie
1039            - dokuwiki <unfixed>
1040            - wordpress <unfixed>
1041    
1042    libphp-jpgraph
1043            - egroupware <unfixed>
1044    
1045    php-simpletest
1046            - moodle <unfixed>
1047    
1048    libpng
1049            - doxygen 1.5.6-2 (embed)
1050            NOTE: Might be fixed earlier. Lenny version recorded.
1051            - gdal 1.5.2-3 (embed)
1052            NOTE: Might be fixed earlier. Lenny version recorded.
1053            - iceweasel <not-affected> (uses xulrunner)
1054            - icedove 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1, 2.0.0.19-1 (embed)
1055            - iceape 1.0.13~pre080614i-0etch1 (embed)
1056            - libfltk1.1 1.1.9-6 (embed)
1057            NOTE: Might be fixed earlier. Lenny version recorded.
1058            - libtk-img <unfixed> (embed)
1059            - htmldoc 1.8.27-3 (embed)
1060            NOTE: Might be fixed earlier. Lenny version recorded.
1061            - xulrunner 1.9.0.13-1 (embed)
1062            [lenny] - xulrunner 1.9.0.11-0lenny1
1063            [etch] - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
1064            - gamera 3.2.3-1 (embed)
1065            - freeimage <unfixed> (embed)
1066            - syslinux-common <unfixable> (embed)
1067            - tuxonice-userui <unfixed> (static)
1068            - texlive-bin 2007.dfsg.2-1~lenny2 (embed)
1069            NOTE: Might be fixed earlier. Lenny version recorded.
1070            - vice 1.22.dfsg1-0.1 (embed)
1071            NOTE: Might be fixed earlier. Lenny version recorded.
1072            - visualboyadvance 1.8.0-4 (embed)
1073            NOTE: Might be fixed earlier. Lenny version recorded.
1074            - ia32-libs <unfixable> (embed)
1075    
1076    irssi
1077            - silc-client <unfixed> (embed)
1078            NOTE: Seems to be a pre-0.8.12 version that is used in irssi-plugin-silc
1079    
1080    extc
1081            - mtasc <unfixed> (embed)
1082            - haxe <unfixed> (embed)
1083    
1084    swflib
1085            - mtasc <unfixed> (embed)
1086            - haxe <unfixed> (embed)
1087    
1088    libitext-java
1089            - bouncycastle 2.1.4-1 (embed)
1090    
1091    python-ply
1092            - pyke <unfixed> (embed; bug #555363)
1093            - pywbem 0.7.0-4 (embed; bug #555364)
1094            - sepolgen <unfixed> (embed; bug #555365)
1095            - zope-textindexng3 <unknown> (embed)
1096            - iceweasel <not-affected> (uses xulrunner)
1097            - xulrunner <unknown> (embed)
1098            - wireshark <not-affected> (python-ply modules are not installed into binary packages; see #554613)
1099    
1100    libdumbnet (libdnet upstream)
1101            - nmap <unfixed> (fork)
1102    
1103    gcc-4.4
1104            - gcc-mingw32 <unfixed> (embed)
1105    
1106    camlimages
1107            - advi <unfixed> (static; bug #550441)
1108    
1109    memcached
1110            - memcachedb <unfixed> (embed)
1111    
1112    yajl
1113            - argyll <unfixed> (embed; bug #544223)
1114            NOTE: reference, confirmed by build logs: http://lists.debian.org/debian-mentors/2009/08/msg00062.html
1115    
1116    nusoap
1117            - gforge 4.8.2-1 (embed)
1118            - ampache <unfixed> (embed)
1119            - poker-network <unfixed> (embed)
1120            - moodle <unfixed> (embed)
1121            NOTE: code is not used when running under php5 and soap is enabled
1122            - phpwiki <unfixed> (embed)
1123            - gallery2 <unfixed> (embed)
1124            - typo3-src <unfixed> (embed)
1125            - phpgacl 3.3.7-7 (embed)
1126            - mantis 1.1.8+dfsg-1 (embed)
1127    
1128    libept
1129            - adept <unfixed> (embed; bug #540649)
1130    
1131    libvorbis
1132            - iceweasel <not-affected> (uses xulrunner)
1133            - xulrunner <unfixed> (embed; bug #540959)
1134            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1135            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1136            - iceape <unfixed> (embed)
1137            [etch] - iceape <not-affected> (introduced in 2.0)
1138            [lenny] - iceape <not-affected> (introduced in 2.0)
1139            - ia32-libs <unfixable> (embed)
1140    
1141    cairo
1142            - iceweasel <not-affected> (uses xulrunner)
1143            - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
1144    
1145    liboggz
1146            - iceweasel <not-affected> (uses xulrunner)
1147            - xulrunner <unfixed> (embed; bug #540959)
1148            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1149            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1150            - iceape <unfixed> (embed)
1151            [etch] - iceape <not-affected> (introduced in 2.0)
1152            [lenny] - iceape <not-affected> (introduced in 2.0)
1153    
1154    liboggplay
1155            - iceweasel <not-affected> (uses xulrunner)
1156            - xulrunner <unfixed> (embed; bug #540959)
1157            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1158            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1159            - iceape <unfixed> (embed)
1160            [etch] - iceape <not-affected> (introduced in 2.0)
1161            [lenny] - iceape <not-affected> (introduced in 2.0)
1162    
1163    php-net-dnsbl
1164            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1165    
1166    php-onyx-rss
1167            - serendipity <unfixed> (embed; bug #541740; wontfix: only one script, own package is overkill, appears not to be duplicated in Debian)
1168    
1169    php-text-wiki
1170            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1171    
1172    php-xml-rpc
1173            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1174    
1175    polarssl (does not have a shared library)
1176            - pdkim <itp> (embed; bug #543150)
1177            - xyssl <unfixed> (old-version)
1178    
1179    pidgin (libpurple)
1180            - gaim <removed> (old-version)
1181            - qutecom 2.2~rc3.hg396~dfsg1-6 (embed; bug #559785)
1182            - wengophone <unfixed> (embed; bug #601425)
1183    
1184    icu
1185            - webkit 1.0.1-1 (embed; bug #547214)
1186            - texlive-bin <unfixed> (fork)
1187            NOTE: texlive upstream working with icu upstream to merge their changes
1188            - chromium-browser 5.0.375.29~r46008-3
1189    
1190    cyrus-imapd-2.2
1191            - kolab-cyrus-imapd <unfixed> (fork)
1192            - dovecot 1:1.2.1-1 (embed) [/dovecot-sieve/src/libsieve/*]
1193    
1194    python-cxx-dev
1195            - freecad 0.9.2646.3-1 (embed; bug #547936)
1196    
1197    zipios++
1198            - freecad 0.9.2646.3-1 (embed; bug #547941)
1199            - enigma 0.92.3-3 (embed)
1200            NOTE: likely fixed earlier, marking etch's version as fixed
1201    
1202    linux-2.6
1203            - kvm <removed> (embed; bug #549973) [./kernel/*]
1204            - linux-kbuild-2.6 <unfixed> (embed; bug #550379) [./kbuild/*]
1205            - kernel-source-2.6.8 <removed> (old-version)
1206            - kernel-source-2.4.27 <removed> (old-version)
1207            - kernel-source-2.4.24 <removed> (old-version)
1208            - kernel-source-2.2.25 <removed> (old-version)
1209            - kernel-source-2.2.20 <removed> (old-version)
1210    
1211    libfdt (not yet packaged separately for debian; http://www.jdl.com/software/)
1212            - kvm <removed> (embed) [./libfdt/*]
1213            - qemu-kvm <unfixed> (embed) [./libfdt/*]
1214    
1215    qweb (not packaged)
1216            - ajaxterm <unfixed>
1217    
1218    opensaml2
1219            - opensaml <removed> (old-version)
1220    
1221    shibboleth-sp2
1222            - shibboleth-sp <removed> (old-version)
1223    
1224    tuxonice-userui
1225            - suspend2-userui <removed> (old-version)
1226    
1227    expat
1228            - w3c-libwww <removed> (embed; bug #551941)
1229            [etch] - w3c-libwww <unfixed> (embed; bug #551941) [./modules/expat/*]
1230            - python-xml <unfixed> (embed; bug #551940) [./extensions/expat/*]
1231            - python2.5 <unfixable> (embed; bug #553403) [./Modules/expat/*]
1232            - python2.4 <unfixable> (embed; bug #553403)
1233            - python2.7 2.7-6 (embed)
1234            - mcabber 0.10.0-1 (low; bug #601053)
1235            - python-4suite <unfixed> (embed; bug #516935)
1236            - wxwindows2.4 <removed> (embed)
1237            - wxwidgets2.6 2.6.3.2.2-4 (embed)
1238            - wxwidgets2.8 2.8.10.1-2 (embed)
1239            - albert <unfixed> (embed; bug #600974)
1240            - celementtree 1.0.5-8 (embed)
1241            NOTE: Maybe that was fixed even earlier
1242            - centerim <unfixed> (embed; bug #559783)
1243            - audacity 1.3.2-1 (embed)
1244            - matanza <unfixed> (embed)
1245            - tdom 0.8.3~20080525-1 (embed)
1246            - udunits 2.1.8-4 (embed)
1247            - apr-util 1.2 (embed)
1248            - ayttm <unfxed> (embed; bug #561006)
1249            - cableswig <unfixed> (embed)
1250            - cadaver <unfixed> (embed)
1251            - cmake 2.6.0-6 (embed)
1252            - coin3 <unfixed> (embed)
1253            - cvsnt 2.5.03.2382-3.3+lenny1 (embed)
1254            NOTE: Might be fixed earlier. Lenny version recorded.
1255            - dasher 4.7.3-1 (embed)
1256            NOTE: Might be fixed earlier. Lenny version recorded.
1257            - emboss 6.3.1-1 (embed)
1258            - gdcm 2.0.14-2 (embed)
1259            - ghostscript 8.71~dfsg-2 (embed)
1260            - grmonitor <removed> (embed)
1261            - iceape <unfixed> (embed)
1262            - insighttoolkit 3.16.0-1 (embed)
1263            NOTE: insighttoolkit might've been fixed earlier
1264            - jabber 1.4.3-3.4 (embed)
1265            NOTE: Might be fixed earlier. Lenny version recorded.
1266            - libparagui1.1 1.0.2-1 (embed)
1267            - libspiff1 0.8.3-1 (embed)
1268            NOTE: Might be fixed earlier. Lenny version recorded.
1269            - paraview 3.6.2-1 (embed)
1270            - poco 1.3.6p1-1 (embed)
1271            - scorched3d 41.3dfsg-1+b1 (embed)
1272            NOTE: Might be fixed earlier. Lenny version recorded.
1273            - simgear <unfixed> (embed)
1274            - sitecopy 1:0.16.0-1
1275            - smart <unfixed> (embed)
1276            NOTE: smart embeds celementree, and it includes expat
1277            - swish-e <not-affected> (Linked against libxml, which is used instead)
1278            - tla 1.3.5+dfsg-15 (embed)
1279            - vtk 4.1.20030227-1 (embed)
1280            - wbxml2 <not-affected> (expat code is only used on Mac OS X, see #560941)
1281            - xmlrpc-c <unfixed> (embed)
1282            - iceweasel <unfixed> (embed)
1283            - kompozer <unfixed> (embed)
1284            - vxl 1.13.0-2 (embed)
1285            - xulrunner <unfixed> (embed)
1286            - xmame 0.106-2.1 (embed)
1287            NOTE: Might be fixed earlier. Lenny version recorded.
1288            - apache2 2.2 (embed)
1289            - texlive-bin <not-affected> (Embedded code not compiled in)
1290            - vnc4 <unfixed> (embed)
1291            - xotcl 1.6.6-1 (embed)
1292            - chromium-browser 5.0.375.29~r46008-3
1293            - ia32-libs <unfixable> (embed)
1294    
1295    xerces-c
1296            - xerces-c2 <unfixed> (old-version)
1297            - xerces27 <removed> (old-version)
1298    
1299    md5 (RSA's version; not the gnu version provided by coreutils)
1300            - w3c-libwww <removed> (embed; bug #551942)
1301            [etch] - w3c-libwww <unfixed> (embed; bug #551942) [./modules/md5/*]
1302    
1303    libparagui1.1
1304            - asc <unfixable> (fork)
1305    
1306    enet
1307            - sauerbraten <unfixed> (embed; #497194)
1308    
1309    eglibc
1310            - glibc <removed> (old-version)
1311            - mksh <unfixable> (static)
1312              NOTE: /bin/mksh-static only, and only on some arches (others use dietlibc)
1313    
1314    galib
1315            - gamera 3.2.3-1 (embed)
1316    
1317    configobj
1318            - bzr <unfixed> (embed; bug #555336)
1319            - elisa <unfixed> (embed; bug #555337)
1320            - gaupol <unfixed> (embed; bug #555338)
1321            - ipython <unfixed> (embed; bug #555339)
1322            - pida <unfixed> (embed; bug #555340)
1323            - psychopy <unfixed> (embed; bug #555341)
1324            - rest2web <unfixed> (embed; bug #555342)
1325            - auth2db <unknown> (embed)
1326            - dynagen <unknown> (embed)
1327            - iceweasel <unknown> (embed)
1328            - sabnzbdplus <unknown> (embed)
1329            - xulrunner <unknown> (embed)
1330            - nipy <not-affected> (part of an example [/examples/neurospin/neurospy/configobj.py], which is not installed into binary packages)
1331    
1332    python-clientform
1333            - bibus <unfixed> (embed; bug #555332)
1334            - zope2.10 <unfixed> (embed; bug #555333)
1335            - zope2.11 <removed> (embed; bug #555334)
1336            - python-mechanize <unknown> (embed)
1337            - twill <unknown> (embed)
1338    
1339    python-mechanize
1340            - zope2.10 <unfixed> (embed; bug #555337)
1341            - zope2.11 <removed> (embed; bug #555338)
1342            - twill <unknown> (embed; bug #555339)
1343    
1344    pexpect
1345            - duplicity 0.6.06-1 (embed; bug #555361)
1346            - hplip <unfixed> (embed; bug #555362)
1347            - smart <unfixed> (embed; bug #555363)
1348    
1349    pyparsing
1350            - bauble <unfixed> (embed; bug #555366)
1351            - boa-constructor 0.6.1-8 (embed; bug #555367)
1352            - calibre <unfixed> (embed; bug #555368)
1353            - matplotlib <unfixed> (embed; bug #531024)
1354            - zhpy 1.7.3.1-1 (embed; bug #555370)
1355            - polybori <unknown> (embed)
1356            - python-whoosh <unknown> (embed)
1357            - twill <unknown> (embed)
1358            - zope-textindexng3 <unknown> (embed)
1359    
1360    python-pysqlite2
1361            - python2.4 <unfixed> (embed; bug #553403)
1362            - python2.5 <unfixed> (embed; bug #553403)
1363    
1364    celementtree
1365            - python2.5 <unfixed> (embed)
1366            - smart <unfixed> (embed)
1367    
1368    elementtree
1369            - python2.5 <unfixed> (embed)
1370            - python2.6 <unfixed> (embed)
1371            - bzr <unfixed> (embed; bug #555343)
1372            - gedit 2.28.2-1 (embed; bug #555344)
1373            - smart <unfixed> (embed)
1374            - solfege <unfixed> (embed; bug #555345)
1375            - w3af <unfixed> (embed; bug #555346)
1376            - python-qt4 <unknown> (embed)
1377            - sphinx <unknown> (embed)
1378            - python-nltk <itp> (embed)
1379    
1380    python2.5
1381            - python2.4 <unfixed> (old-version)
1382            - jython <unfixed> (embed)
1383            NOTE: embeds many stdlib modules
1384            - python-django <unfixed> (embed; bug #555419)
1385            NOTE: embeds stdlib modules: doctest, decimal
1386            - gamera 3.2.3-1 (embed)
1387            NOTE: embeds stdlib modules: ConfigParser, optparse, sets, textwrap
1388            - boa-constructor <unfixed> (embed; bug #555426)
1389            NOTE: embeds stdlib modules: ConfigParser, tarfile, zipfile, xmlrpclib
1390            - nicotine <unfixed> (embed; bug #555427)
1391            NOTE: embeds stdlib modules: ConfigParser
1392            - museek+ <unfixed> (embed; bug #555428)
1393            NOTE: embeds stdlib modules: ConfigParser
1394            - vegastrike-data <removed> (embed)
1395            NOTE: embeds many stdlib modules
1396            - codespeak-lib 1.1.1-1 (embed; bug #555420)
1397            NOTE: embeds stdlib modules: doctest, optparse, subprocess, textwrap
1398            - config-manager <unfixed> (embed; bug #555423)
1399            NOTE: embeds stdlib modules: optparse
1400            - jhbuild 2.28.0-1 (embed; bug #555421)
1401            NOTE: embeds stdlib modules: optparse, subprocess
1402            - smart <unfixed> (embed; bug #555432)
1403            NOTE: embeds stdlib modules: optparse
1404            - pyprotocols 1.0a.svn20070625-5 (embed; bug #555433)
1405            NOTE: embeds stdlib modules: doctest
1406            - ruledispatch 0.5a.svn20080510-4 (embed; bug #555434)
1407            NOTE: embeds stdlib modules: doctest
1408            - distribute <unfixed> (embed)
1409            NOTE: embeds stdlib modules: doctest
1410            - python-setuptools <unfixed> (embed; bug #555435)
1411            NOTE: embeds stdlib modules: doctest
1412            - zope.testing <unfixed> (embed; bug #555436)
1413            NOTE: embeds stdlib modules: doctest
1414            - translate-toolkit <unfixed> (embed; bug #555422)
1415            NOTE: embeds stdlib modules: textwrap, contextlib
1416            - libtpclient-py <unfixed> (embed; bug #555424)
1417            NOTE: embeds stdlib modules: subprocess
1418            - grass <unfixed> (embed; bug #555425)
1419            NOTE: embeds stdlib modules: subprocess
1420            - coherence <unfixed> (embed; bug #555429)
1421            NOTE: embeds stdlib modules: uuid
1422            - python-django-extensions 0.4.2pre+git200911182050-1 (embed; bug #555430)
1423            NOTE: embeds stdlib modules: uuid
1424            - setroubleshoot <removed> (embed; bug #555431)
1425            NOTE: embeds stdlib modules: uuid
1426            - linkchecker <unfixed> (embed; bug #555414)
1427            NOTE: embeds msgfmt.py script
1428            - imdbpy <unfixed> (embed)
1429            NOTE: embeds msgfmt.py script
1430            - kiwi <unfixed> (embed)
1431            NOTE: embeds msgfmt.py script
1432            - moin <unfixed> (embed)
1433            NOTE: embeds msgfmt.py script, stdlib modules: cgitb, difflib, tarfile
1434            - plone3 <removed> (embed)
1435            NOTE: embeds msgfmt.py script
1436            - roundup <unfixed> (embed)
1437            NOTE: embeds msgfmt.py script, stdlib modules: cgitb
1438            - rednotebook <unfixed> (embed; bug #555415)
1439            NOTE: embeds msgfmt.py script
1440            - turbogears <unfixed> (embed)
1441            NOTE: embeds msgfmt.py script
1442            - elisa <unfixed> (embed)
1443            NOTE: embeds msgfmt.py script, stdlib modules: uuid
1444            - calibre <unfixed> (embed)
1445            NOTE: embeds msgfmt.py script, stdlib modules: zipfile
1446            - mailman 1:2.1.13-1 (embed; #555416)
1447            NOTE: embeds msgfmt.py script
1448            - python-docutils <unknown> (embed)
1449            NOTE: embeds stdlib modules: optparse, textwrap
1450            - python-imaging <unknown> (embed)
1451            NOTE: embeds stdlib modules: doctest
1452            - python-mechanize <unknown> (embed)
1453            NOTE: embeds stdlib modules: doctest
1454            - twill <unknown> (embed)
1455            NOTE: embeds stdlib modules: subprocess
1456            - zeroc-ice <unknown> (embed)
1457            NOTE: embeds stdlib modules: subprocess
1458            - wxwidgets2.8 <unknown> (embed)
1459            NOTE: embeds stdlib modules: subprocess
1460            - cycle <unknown> (embed)
1461            NOTE: embeds msgfmt.py script
1462            - deluge <unknown> (embed)
1463            NOTE: embeds msgfmt.py script
1464            - opendict <unknown> (embed)
1465            NOTE: embeds msgfmt.py script
1466            - openerp-client <unknown> (embed)
1467            NOTE: embeds msgfmt.py script
1468            - rapidsvn <unknown> (embed)
1469            NOTE: embeds msgfmt.py script
1470            - wammu <unknown> (embed)
1471            NOTE: embeds msgfmt.py script
1472            - gaphor <unknown> (embed)
1473            NOTE: embeds msgfmt.py script
1474            - pida <unknown> (embed)
1475            NOTE: embeds msgfmt.py script
1476            - python-formencode <unknown> (embed)
1477            NOTE: embeds msgfmt.py script
1478            - duplicity <unfixed> (embed)
1479            NOTE: embeds stdlib module: urlparse, tarfile
1480            - pygopherd <unfixed> (embed)
1481            NOTE: embeds stdlib module: zipfile
1482    
1483    argparse
1484            - twill <unfixed> (embed; bug #555347)
1485            - ipython <unfixed> (embed; bug #555348)
1486    
1487    coherence
1488            - elisa <unfixed> (embed; bug #555335)
1489    
1490    simpletal
1491            - plastex <unfixed> (embed; bug #555371)
1492    
1493    flickrpc (not packaged in Debian, http://burtonini.com/bzr/flickrpc/)
1494            - postr <unfixed> (embed)
1495            - elisa <unfixed> (embed)
1496    
1497    simplegeneric (not packaged in Debian, http://pypi.python.org/pypi/simplegeneric)
1498            - apertium-tolk <unfixed> (embed)
1499            - ipython <unfixed> (embed)
1500            - virtaal <unfixed> (embed)
1501    
1502    distribute
1503            - setuptools <removed> (old-version)
1504    
1505    rails
1506            - jruby1.2 <removed> (embed) [./bench/rails/*]
1507            NOTE: jruby is in non-free, it probably includes rails too
1508            - libgettext-ruby <unfixed> (embed) [./samples/rails/*]
1509            - libopenid-ruby <unfixed> (embed) [./examples/rails_openid/*]
1510            - thin <unfixed> (embed) [./spec/rails_app/*]
1511            NOTE: this is a subdirectory of examples, which in general is a non-issue, but may
1512            NOTE: be dangerous if developers are naively basing their code off of the examples
1513            NOTE: prototype.js is among the example files
1514    
1515    lucene2 (prototype.js is among the embeds in the following)
1516            - lucene <unfixed> (old-version)
1517            - pylucene <unfixed> (embed)
1518            - libpdfbox-java <unfixed> (embed)
1519            - libfontbox-java <unfixed> (embed)
1520            - libjempbox-java <unfixed> (embed)
1521            - solr <unfixed> (embed)
1522    
1523    unicode-data
1524            - syslinux <unfixed> (embed)
1525            - camomile <unfixed> (embed)
1526            - fribidi <unfixed> (embed)
1527            - m17n-db <unfixed> (embed)
1528            - sbcl <unfixed> (embed)
1529            - heimdal <unfixed> (embed)
1530            - icu <unfixed> (embed)
1531            - icu4j <unfixed> (embed)
1532            - krb5 <unfixed> (embed)
1533            - moodle <unfixed> (embed)
1534            - openldap <unfixed> (embed)
1535            - pike7.6 <unfixed> (embed)
1536            - samba <unfixed> (embed)
1537            - samba4 <unfixed> (embed)
1538            - cmucl <unfixed> (embed)
1539            - typo3-src <unfixed> (embed)
1540            - mauve <unfixed> (embed)
1541            - texlive-bin <unfixed> (embed)
1542            - ypsilon <unfixed> (embed)
1543            - jeuclid <unfixed> (embed)
1544            - charmap.app <unfixed> (embed)
1545            - clisp <unfixed> (embed)
1546            - gnulib <unfixed> (embed)
1547            - opensrs-client <unfixed> (embed)
1548            - saxonb <unfixed> (embed)
1549            - rails <unfixed> (embed)
1550    
1551    feedparser
1552            - rawdog <unfixed> (embed; bug #383422)
1553            - miro <unfixed> (embed; bug #555351)
1554            - calibre <unfixed> (embed; bug #555352)
1555            - freevo <unfixed> (embed; bug #555353)
1556            - pida <unfixed> (embed; bug #555354)
1557            - planet-venus <unfixed> (embed; bug #555355)
1558            - plone3 <removed> (embed; bug #555356)
1559            - exaile 0.2.14+debian-1 (embed)
1560            - screenlets 0.1.2-3 (embed)
1561            NOTE: included twice
1562    
1563    agg:
1564            - matplotlib <unfixed> (embed: bug #377271)
1565            - contextfree <unfixed> (embed)
1566            NOTE: since 2.2-1 it links statically to system libagg, but still uses the embedded copy
1567            - exactimage <unfixed> (embed)
1568            - python-enable <unfixed> (embed)
1569            - mapnik 0.5.1-3 (embed)
1570            NOTE: links statically to agg, but shared library is not available (bug #377271)
1571    
1572    vtk
1573            - paraview <unfixable> (embed; bug #495426)
1574    
1575    txt2tags
1576            - rednotebook <unfixed> (embed)
1577    
1578    htmltextview (not packaged in Debian, http://www.gnome.org/~gjc/htmltextview.py)
1579            - gajim <unfixed> (embed)
1580            - emesene <unfixed> (embed)
1581            - convirt <unfixed> (embed)
1582            - pida <unfixed> (embed)
1583            - rednotebook <unfixed> (embed)
1584    
1585    horde3 (prototype.js is among the embeds in the following)
1586            - mnemo2 <unfixed> (embed)
1587            - nag2 <unfixed> (embed)
1588            - wordpress <unfixed> (embed)
1589            NOTE: Text_Diff (wp-includes/Text/Diff*)
1590    
1591    cimg
1592            - gmic <unfixed> (embed)
1593    
1594    mootools
1595            - kdenetwork <unfixed> (embed)
1596            - gallery <unfixed> (embed)
1597            - jspwiki <unfixed> (embed)
1598            - vdr-plugin-live <unfixed> (embed)
1599            - perl-doc-html <unfixed> (embed)
1600    
1601    openldap
1602            - openldap2.3 <removed> (old-version)
1603            - ia32-libs <unfixable> (embed)
1604    
1605    grub2
1606            - grub <unfixed> (old-version)
1607    
1608    gnupginterface
1609            - duplicity <unfixed> (embed)
1610    
1611    python-dateutil
1612            - awn-extras-applets <unfixed> (embed)
1613            - matplotlib <unknown> (embed)
1614    
1615    cups
1616            - cupsys <removed> (old-version)
1617            - ia32-libs <unfixable> (embed)
1618    
1619    yui
1620            - bcfg2 <not-affected> (present in source but not included in any binary files)
1621            - serendipity 1.5.3-1 (embed; bug #557746)
1622            - moodle 1.8.2.dfsg-5 (embed)
1623            - jifty 0.91117-1 (embed; bug #557748)
1624            - webgui 7.7.26-1 (embed)
1625            - loggerhead 1.17-1 (embed)
1626            - otrs2 2.4.7+dfsg1-1 (embed; bug #592146)
1627    
1628    quake3 (vanilla source not packaged in debian)
1629            - openarena <unfixable> (fork)
1630    
1631    quake2 (vanilla source not packaged in debian)
1632            - alien-arena <unfixable> (fork)
1633            - warsow <unfixable> (fork)
1634    
1635    libtheora
1636            - iceweasel <not-affected> (uses xulrunner)
1637            - xulrunner <unfixed> (embed; bug #540959)
1638            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1639            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1640            - iceape <unfixed> (embed; bug #559276)
1641            [etch] - iceape <not-affected> (introduced in iceape 2.0)
1642            [lenny] - iceape <not-affected> (introduced in iceape 2.0)
1643    
1644    dtoa
1645            - bfilter <unfixed> (embed)
1646            - cacao <removed> (embed)
1647            - cdrdao <unfixed> (embed)
1648            - classpath <unfixed> (embed)
1649            - freej <unfixed> (embed)
1650            - iceape <unfixed> (embed)
1651            - iceweasel <unfixed> (embed)
1652            - jscoverage <unfixed> (embed)
1653            - kde4libs <unfixed> (embed)
1654            - kdelibs <unfixed> (embed)
1655            - kompozer <unfixed> (embed)
1656            - libv8 <unfixed> (embed)
1657            - mono <unfixed> (embed)
1658            - newlib <unfixed> (embed)
1659            - nspr <unfixed> (embed)
1660            - php5 <unfixed> (embed)
1661            - polyml <unfixed> (embed)
1662            - qt4-x11 <unfixed> (embed)
1663            - rhino <unfixed> (embed)
1664            NOTE: code translated to Java
1665            - ruby1.8 <unfixed> (embed)
1666            - ruby1.9 <unfixed> (embed)
1667            - ruby1.9.1 <unfixed> (embed)
1668            - sdd <unfixed> (embed)
1669            - sfind <unfixed> (embed)
1670            - star <unfixed> (embed)
1671            - tinymux <unfixed> (embed)
1672            - virtualbox-ose <unfixed> (embed)
1673            - webkit <unfixed> (embed)
1674            - xulrunner <unfixed> (embed)
1675    
1676    ipc (not packaged in Debian; see http://mozdev.org/pipermail/enigmail/2009-November/011678.html)
1677            - firegpg <unfixed> (embed)
1678            - enigmail <unfixed> (embed)
1679    
1680    ptmalloc (not packaged in Debian)
1681            - crystalspace <unfixed> (embed)
1682            - qt4-x11 <unfixed> (embed)
1683    
1684    svgalib
1685            - usplash <unfixed> (embed)
1686            - ia32-libs <unfixable> (embed)
1687    
1688    bogl
1689            - usplash <unfixed> (embed)
1690    
1691    taglist
1692            - usplash <unfixed> (embed)
1693    
1694    portaudio
1695            - audacity <unfixed> (embed; bug #323711)
1696    
1697    nyquist
1698            - audacity <unfixed> (embed)
1699            NOTE: embeds a forked nyquist with support for a shared library
1700    
1701    vamp-plugin-sdk
1702            - audacity <unfixed> (embed)
1703    
1704    wordpress
1705            - libwordpress-xmlrpc-perl <removed> (embed) [./xmlrpc.php]
1706            - wordpress-mu <removed> (fork)
1707    
1708    php5
1709            - php4 <removed> (old-version)
1710    
1711    classpath
1712            - libgnucrypto-java <removed> (embed; bug #559788)
1713    
1714    libtool
1715            - apr <unfixed> (static; bug #489625)
1716            NOTE: ships copy of libtool in libapr1-dev; was 'embed' before 1.3.2-3
1717            - arts <unfixed> (embed)
1718            - bochs 2.4.2-1 (embed; bug #560884)
1719            - camserv <unfixed> (embed)
1720            - collectd 4.8.2-1 (embed)
1721            - courier-authlib 0.58-4 (embed)
1722            NOTE: The etch version of courier-authlib was the earliest version checked, might be fixed earlier
1723            - cvsnt 2.5.04.3236-1.2 (embed)
1724            - dico <not-affected> (Uses the system copy of ltdl)
1725            - freeradius 0.1+20010527-1 (embed)
1726            NOTE: Earliest reference I could find from the changelog is from 27 May 2001
1727            - ggobi 2.1.9~20091212-1 (embed)
1728            - glame 2.0.1-4 (embed)
1729            NOTE: The etch version of glame was the earliest version checked, might be fixed earlier
1730            - gnash 0.8.7-2 (embed)
1731            - gnu-smalltalk <unfixed> (embed; bug #566777)
1732            - google-gadgets 0.10.5-0.3 (embed)
1733            NOTE: 0.10.5-0.3 was the earliest version checked, was fixed earlier
1734            - graphicsmagick 1.3.5-6 (embed)
1735            - graphviz 2.8-3 (embed)
1736            NOTE: The etch version of graphviz was the earliest version checked, might be fixed earlier
1737            - guile-1.6 1.6.8-7 (embed)
1738            - hamlib 1.2.11-1 (embed)
1739            - hercules 3.06-1.2 (embed)
1740            - jags 1.0.4-3 (embed; bug #560864)
1741            - kdelibs <unfixed> (embed)
1742            - libannodex <removed> (embed)
1743            - libextractor 0.5.23+dfsg-4 (embed)
1744            - libmcrypt <not-affected> (libtool source present but not included in any of the binary packages)
1745            - libtunepimp 0.5.3-7.3 (embed)
1746            - mp4h 1.3.1-4.1 (embed)
1747            - naim <removed> (embed)
1748            - parser-mysql <unfixed> (embed)
1749            - pinball 0.3.1-11 (embed)
1750            - redland <unfixed> (embed)
1751            - siproxd <unfixed> (embed)
1752            - ski <unfixed> (embed)
1753            - synfig 0.62.00-1 (embed)
1754            - unixodbc 2.2.4-5 (embed)
1755            - xmlsec1 <not-affected> (Doesn't enable dynamic loading of crypto modules)
1756            - clamav 0.95+dfsg-1 (embed)
1757            - imagemagick 6:6.2.3.1-1 (embed)
1758            - hypre 2.4.0b-5 (embed)
1759            - lam <unfixed> (embed)
1760            - openmpi <unfixable> (embed; bug #559386)
1761            - parser <unfixed> (embed)
1762            - pdsh 2.18-5 (embed; bug #560892)
1763            - sbnc 1.2-8 (embed)
1764            - sdcc <unfixed> (embed)
1765            - wml <not-affected> (The embedded ltdl isn't used, instead mp4h is used, see 559841)
1766            - proftpd-dfsg <unfixed> (embed; bug #561748)
1767            - babel 1.4.0.dfsg-5 (embed)
1768            - libprelude 0.9.14-2 (embed)
1769            - heartbeat 2.1.4-7 (embed)
1770            NOTE: From Squeeze onwards the system copy of ltdl is used, use the current version from Squeeze,
1771            NOTE: might've been fixed earlier
1772            - gcc-* <unknown> (embed)
1773            - ia32-libs <unfixable> (embed)
1774    
1775    ocamlgsl
1776            - orpie 1.5.1-7.1 (embed; bug #550058)
1777    
1778    xdotool
1779            - keynav <unfixed> (embed; bug #560103)
1780    
1781    bulletphysics (not packaged; http://www.bulletphysics.org/)
1782            - supertuxkart <unfixed> (embed)
1783            - blender <unfixed> (embed)
1784    
1785    ghostscript
1786            - gs-gpl <removed> (old-version)
1787    
1788    icedove
1789            - thunderbird <removed> (old-version)
1790    
1791    sizzlejs (not packaged in Debian, http://sizzlejs.com/)
1792            - jquery <unfixed> (embed)
1793    
1794    sed
1795            - ssed <unfixed> (fork)
1796    
1797    phpatomlib (http://code.google.com/p/phpatomlib)
1798            - wordpress <unfixed> (embed)
1799    
1800    Services_JSON (http://pear.php.net/package/Services_JSON)
1801            - wordpress <unfixed> (embed)
1802    
1803    phpass (http://www.openwall.com/phpass/)
1804            - gallery2 <unfixed> (embed)
1805            - wordpress <unfixed> (embed)
1806            - typo3-src <unfixed> (modified-embed)
1807            NOTE: file refers to drupal, maybe there's a copy somewhere there
1808            NOTE: a copyright owner search didn't match anything
1809            - libauthen-passphrase-perl <unfixable> (fork)
1810            NOTE: perl implementation of phpass
1811            - phpbb3 <unfixed>
1812            NOTE: hash identifier modified: s/P/H/; recent version 0.3 of phpass recognises it
1813    
1814    squirrelmail
1815            - wordpress <unfixed> (embed)
1816            NOTE: class-pop3.php
1817    
1818    ezSQL (http://www.woyano.com/jv/ezsql)
1819            - wordpress <unfixable> (fork)
1820            NOTE: wp-db.php
1821    
1822    Diff.php (Clay Loveless' version/killersoft.com)
1823            - php-versioncontrol-svn <unfixed>
1824    
1825    libm (provided by libc)
1826            - spring <unfixed> (embed)
1827            NOTE: embedded by embedded copy of streflop
1828            - aide <unfixed> (static)
1829            - busybox <unfixed> (static)
1830            - mindi-busybox <unfixed> (static)
1831            - qemu <unfixed> (static)
1832            NOTE: qemu-user-static
1833            - tuxonice-userui <unfixed> (static)
1834            - zsh <unfixed> (static)
1835            NOTE: zsh-static
1836            - tripwire <unfixed>
1837    
1838    streflop
1839            - spring <unfixed> (embed)
1840    
1841    minizip
1842            - spring <unfixed> (embed)
1843    
1844    oscpack
1845            - spring <unfixed> (embed)
1846    
1847    hpiutil2
1848            - spring <unfixed> (embed)
1849    
1850    p7zip
1851            - spring <unfixed> (embed)
1852    
1853    pythonqt (doesn't seem to be python-qtN, unknown source)
1854            - fontmatrix <unfixed> (embed)
1855            - elmerfem <unfixed> (embed)
1856    
1857    iepngfix (not packaged in Debian; http://www.twinhelix.com/css/iepngfix/)
1858            - docvert <unfixed> (embed)
1859            - jifty <unfixed> (embed)
1860            - kdenetwork <unfixed> (embed)
1861            - mediatomb <unfixed> (embed)
1862            - plastex <unfixed> (embed)
1863            - plone3 <removed> (embed)
1864            - python-chaco <unfixed> (embed)
1865            - python-docutils <unfixed> (embed)
1866            - s5 <unfixed> (embed)
1867            - zope2.10 <unfixed> (embed)
1868            - zope2.11 <removed> (embed)
1869            - cython <not-affcted> (embed)
1870            NOTE: part of documentation, which is not installed into the binary package
1871    
1872    python-docutils
1873            - zope2.10 <unfixed> (embed)
1874            - zope2.11 <removed> (embed)
1875    
1876    tesseract
1877            - ocropus <unfixed> (static)
1878    
1879    antlr
1880            - kdevelop <unfixed> (embed)
1881    
1882    libxerces2
1883            - openjdk-6 <unfixed> (embed)
1884    
1885    kfreebsd-8
1886            - kfreebsd-7 <unfixed> (old-version)
1887            - kfreebsd-6 <removed> (old-version)
1888    
1889    ruby1.9.1
1890            - ruby1.9 <unfixed> (old-version)
1891            - ruby1.8 <unfixed> (old-version)
1892    
1893    maildrop
1894            - courier <unfixed> (embed) [./maildrop]
1895    
1896    glee
1897            - warzone2100 <not-affected> (embed)
1898    
1899    phing
1900            - symfony <unfixed> (embed)
1901    
1902    pake
1903            - symfony <unfixed> (embed)
1904    
1905    propel
1906            - symfony <unfixed> (embed)
1907    
1908    creole
1909            - symfony <unfixed> (embed)
1910    
1911    hfsutils
1912            - cdrkit <unfixed> (embed; bug #570187)
1913            NOTE: embeds hfsutils code in genisoimage
1914    
1915    cdrkit
1916            - grub2 <unfixed> (embed; bug #570156)
1917            NOTE: genisoimage imported into grub-mkisofs
1918    
1919    kdebase-workspace
1920            - kdebase <unfixed> (old-version)
1921    
1922    file
1923            - php5 <unfixable> (modified-embed)
1924            [lenny] - php5 <not-affected>
1925    
1926    cdb
1927            - php5 <unfixed> (embed)
1928    
1929    libmbfl (itp: #570708)
1930            - php5 <unfixed> (embed)
1931            NOTE: PHP is actually the current upstream, ITP is of that code
1932    
1933    libonig
1934            - php5 5.3.2-1 (embed)
1935    
1936    xmlrpc-epi
1937            - php5 <unfixed> (embed)
1938    
1939    swt-gtk
1940            - eclipse <unfixed> (embed; bug #538808)
1941    
1942    txt2html
1943            - wml 2.0.11ds2-1 (embed)
1944    
1945    ca-certificates
1946            - nss <not-affected> (certificates are in source, but not included in any of the binary packages)
1947    
1948    openexr
1949            - freeimage <unfixed> (embed)
1950    
1951    libmng
1952            - freeimage <unfixed> (embed)
1953    
1954    openjpeg
1955            - freeimage <unfixed> (embed)
1956    
1957    libjpeg6b
1958            - freeimage <unfixed> (embed)
1959            - ia32-libs <unfixable> (embed)
1960    
1961    libjpeg (don't know what exact version)
1962            - dcmtk <unfixed>
1963            - gdcm <unfixed>
1964            - insighttoolkit <unfixed>
1965            - openarena 0.8.5-5+exp1 (bug #495966)
1966            - outguess <unfixed>
1967            - squeak-vm <unfixed> (embed)
1968            - tremulous <unfixed>
1969            - tuxonice-userui <unfixed> (static)
1970            - fpc <unfixed> (static)
1971            - lazarus <unfixed> (static)
1972            NOTE: inherited from fpc, see #472304
1973            - mseide-msegui <unfixed> (static)
1974            NOTE: inherited from fpc, see #472304
1975            - easymp3gain <unfixed> (static)
1976            NOTE: inherited from fpc, see #472304
1977            - winff <unfixed> (static)
1978            NOTE: inherited from fpc, see #472304
1979            - texlive-bin <not-affected> (included in upstream source as dependency of libgd2, but not built or included in any of the binary packages)
1980    
1981    
1982    lxr
1983            - lxr-cvs <unfixed> (embed)
1984    
1985    libfile-copy-recursive-perl
1986            - r-base <unfixed> (embed; bug #577427)
1987            - r-base-core-ra <unfixed> (embed; bug #577429)
1988    
1989    delimmatch
1990            - r-base <unfixed> (embed; bug #577433)
1991            - r-base-core-ra <unfixed> (embed; bug #577434)
1992    
1993    libsmf (ITP: #572558)
1994            - denemo <unfixed> (embed)
1995            NOTE: http://lists.debian.org/debian-mentors/2010/04/msg00269.html
1996    
1997    libselinux
1998            - dpkg 1.15.6 (static)
1999            - ia32-libs <unfixable> (embed)
2000    
2001    xinha (ITP: #479708)
2002            - horde3 <unfixed>
2003            - serendipity <unfixed>
2004            - openacs <unfixed>
2005            - dotlrn <unfixed>
2006    
2007    dvipng
2008            - texlive-bin <not-affected> (code present in source but not included in the binary packages)
2009    
2010    dvipdfmx
2011            - texlive-bin <unfixed> (embed)
2012            NOTE: this is intentionally part of the package now, and the separate dvipdfmx package has been removed from sid/squeeze
2013    
2014    lcdf-typetools
2015            - texlive-bin 2009-1 (embed)
2016    
2017    tex4ht
2018            - texlive-bin 2009-1 (embed)
2019    
2020    freetype
2021            - texlive-bin 2009-1 (embed)
2022            - ia32-libs <unfixable> (embed)
2023    
2024    freetype2
2025            - texlive-bin 2009-1 (embed)
2026    
2027    silgraphite
2028            - texlive-bin <unfixed> (embed)
2029    
2030    unzip
2031            - texlive-bin 2009-1 (embed)
2032    
2033    jbig2dec
2034            - ghostscript 8.71~dfsg2-1 (embed)
2035    
2036    libxml2
2037            - chromium-browser 5.0.375.29~r46008-1
2038            - ia32-libs <unfixable> (embed)
2039    
2040    protobuf
2041            - chromium-browser 5.0.375.70~r48679-2
2042    
2043    libv8
2044            - chromium-browser 5.0.375.38~r46659-1
2045    
2046    nspr
2047            - chromium-browser 5.0.375.29~r46008-3
2048            - ia32-libs <unfixable> (embed)
2049    
2050    yasm
2051            - chromium-browser 5.0.375.29~r46008-2
2052    
2053    libxslt
2054            - chromium-browser 5.0.375.29~r46008-1
2055            - ia32-libs <unfixable> (embed)
2056    
2057    miniupnpc (not packaged in Debian; ITP bug #444392)
2058            - warzone2100 <unfixed> (embed)
2059    
2060    iniparser (not packaged in Debian; RFP bug #582657)
2061            - warzone2100 <unfixed> (modified-embed)
2062    
2063    pyglet
2064            - sympy <unfixed> (embed; bug #459716)
2065    
2066    mpmath
2067            - sympy <unfixed> (embed; bug #541746)
2068    
2069    openssh
2070            - libpam-ssh <unfixed> (embed; bug #598522)
2071    
2072    curl
2073            - cmake 2.6.0-6 (embed)
2074            NOTE: Might be fixed earlier. Lenny version recorded.
2075            - criticalmass <unfixed> (static; bug #599061)
2076            - wengophone 2.1.0~beta1-svn9983-1 (embed)
2077            - ia32-libs <unfixable> (embed)
2078    
2079    lib3ds
2080            - boson <unfixed> (embed; bug #600900)
2081            - openscenegraph <unfixed> (embed; bug #601181)
2082    
2083    xcftools
2084            - gnome-xcf-thumbnailer <unfixed> (embed)
2085    
2086    simplejson
2087            - exaile <unfixed> (embed; bug #604547)
2088    
2089    libasycns
2090            - loudmouth <unfixed> (embed; bug #566143)
2091    
2092    plplot
2093            - emboss <unfixed> (fork)
2094    
2095    acl
2096            - ia32-libs <unfixable> (embed)
2097    
2098    arts
2099            - ia32-libs <unfixable> (embed)
2100    
2101    attr
2102            - ia32-libs <unfixable> (embed)
2103    
2104    audiofile
2105            - ia32-libs <unfixable> (embed)
2106    
2107    avahi
2108            - ia32-libs <unfixable> (embed)
2109    
2110    celt
2111            - ia32-libs <unfixable> (embed)
2112    
2113    coreutils
2114            - ia32-libs <unfixable> (embed)
2115    
2116    cyrus-sasl2
2117            - ia32-libs <unfixable> (embed)
2118    
2119    db4.8
2120            - ia32-libs <unfixable> (embed)
2121    
2122    dbus
2123            - ia32-libs <unfixable> (embed)
2124    
2125    directfb
2126            - ia32-libs <unfixable> (embed)
2127    
2128    esound
2129            - ia32-libs <unfixable> (embed)
2130    
2131    fltk1.1
2132            - ia32-libs <unfixable> (embed)
2133    
2134    fontconfig
2135            - ia32-libs <unfixable> (embed)
2136    
2137    freeglut
2138            - ia32-libs <unfixable> (embed)
2139    
2140    gcc-3.3
2141            - ia32-libs <unfixable> (embed)
2142    
2143    gdbm
2144            - ia32-libs <unfixable> (embed)
2145    
2146    gnutls26
2147            - ia32-libs <unfixable> (embed)
2148    
2149    hal
2150            - ia32-libs <unfixable> (embed)
2151    
2152    isdnutils
2153            - ia32-libs <unfixable> (embed)
2154    
2155  zlib code: (separate between 1.2 and 1.1)  jack-audio-connection-kit
2156  dpkg          - ia32-libs <unfixable> (embed)
 rsync  
 mozilla-firefox  
 mozilla(?)  
 Linux kernels  
2157    
2158    keyutils
2159            - ia32-libs <unfixable> (embed)
2160    
2161  libgadu/ekg:  krb5
2162  centericq          - ia32-libs <unfixable> (embed)
 gaim  
 kopete (ships the code, but links dynamically in the Debian package)  
 kadu (not packaged in Debian)  
 GNU gadu (not packaged in Debian)  
2163    
2164    lesstif2
2165            - ia32-libs <unfixable> (embed)
2166    
2167  xmlrpc: (which package is the "origin" of this code?)  libaio
2168  drupal          - ia32-libs <unfixable> (embed)
 phpgroupware  
 egroupware  
 phpwiki  
 php4 (php-pear, IIRC this was reorganized some weeks ago?)  
 tikiwiki (not packaged in Debian)  
2169    
2170    libasyncns
2171            - ia32-libs <unfixable> (embed)
2172    
2173  shtool: (affects build-time only)  libcap2
2174  mysql-ocaml          - ia32-libs <unfixable> (embed)
 php4  
2175    
2176    libdrm
2177            - ia32-libs <unfixable> (embed)
2178    
2179  mozilla:  libedit
2180  mozilla-firefox          - ia32-libs <unfixable> (embed)
 mozilla-thunderbird  
 nvu  
2181    
2182    libexif
2183            - ia32-libs <unfixable> (embed)
2184    
2185  xli:  libgcrypt11
2186  xloadimage          - ia32-libs <unfixable> (embed)
2187    
2188    libgpg-error
2189            - ia32-libs <unfixable> (embed)
2190    
2191  lesstif: (beware: two different lesstif APIs supported in one package, 1.2 discarded upstream)  libgphoto2
2192  openmotif          - ia32-libs <unfixable> (embed)
 xfree86/xorg (in libxpm, still the case with x.org?  
2193    
2194    libice
2195            - ia32-libs <unfixable> (embed)
2196    
2197  kerberized apps with BSD origin:  libieee1284
2198  krb4          - ia32-libs <unfixable> (embed)
2199  krb5  
2200  heimdal  libjpeg8
2201            - ia32-libs <unfixable> (embed)
2202    
2203    libnss-ldap
2204            - ia32-libs <unfixable> (embed)
2205    
2206    libogg
2207            - ia32-libs <unfixable> (embed)
2208    
2209    libpam-ldap
2210            - ia32-libs <unfixable> (embed)
2211    
2212    libsamplerate
2213            - ia32-libs <unfixable> (embed)
2214    
2215    libsdl1.2
2216            - ia32-libs <unfixable> (embed)
2217    
2218    libsm
2219            - ia32-libs <unfixable> (embed)
2220    
2221    libssh2
2222            - ia32-libs <unfixable> (embed)
2223    
2224    libtasn1-3
2225            - ia32-libs <unfixable> (embed)
2226    
2227    libx11
2228            - ia32-libs <unfixable> (embed)
2229    
2230    libx86
2231            - ia32-libs <unfixable> (embed)
2232    
2233    libxau
2234            - ia32-libs <unfixable> (embed)
2235    
2236    libxcb
2237            - ia32-libs <unfixable> (embed)
2238    
2239    libxcomposite
2240            - ia32-libs <unfixable> (embed)
2241    
2242    libxcursor
2243            - ia32-libs <unfixable> (embed)
2244    
2245    libxdamage
2246            - ia32-libs <unfixable> (embed)
2247    
2248    libxdmcp
2249            - ia32-libs <unfixable> (embed)
2250    
2251    libxext
2252            - ia32-libs <unfixable> (embed)
2253    
2254    libxfixes
2255            - ia32-libs <unfixable> (embed)
2256    
2257    libxi
2258            - ia32-libs <unfixable> (embed)
2259    
2260    libxinerama
2261            - ia32-libs <unfixable> (embed)
2262    
2263    libxmu
2264            - ia32-libs <unfixable> (embed)
2265    
2266    libxp
2267            - ia32-libs <unfixable> (embed)
2268    
2269    libxrandr
2270            - ia32-libs <unfixable> (embed)
2271    
2272    libxrender
2273            - ia32-libs <unfixable> (embed)
2274    
2275    libxss
2276            - ia32-libs <unfixable> (embed)
2277    
2278    libxt
2279            - ia32-libs <unfixable> (embed)
2280    
2281    libxtst
2282            - ia32-libs <unfixable> (embed)
2283    
2284    libxv
2285            - ia32-libs <unfixable> (embed)
2286    
2287    libxxf86vm
2288            - ia32-libs <unfixable> (embed)
2289    
2290    lzo2
2291            - ia32-libs <unfixable> (embed)
2292    
2293    mesa
2294            - ia32-libs <unfixable> (embed)
2295    
2296    mpg123
2297            - ia32-libs <unfixable> (embed)
2298    
2299    nas
2300            - ia32-libs <unfixable> (embed)
2301    
2302    nss
2303            - ia32-libs <unfixable> (embed)
2304    
2305    openal-soft
2306            - ia32-libs <unfixable> (embed)
2307    
2308    openssl
2309            - ia32-libs <unfixable> (embed)
2310    
2311    pam
2312            - ia32-libs <unfixable> (embed)
2313    
2314    popt
2315            - ia32-libs <unfixable> (embed)
2316    
2317    pulseaudio
2318            - ia32-libs <unfixable> (embed)
2319    
2320    sane-backends
2321            - ia32-libs <unfixable> (embed)
2322    
2323  grip: (which pkg is the origin?)  sqlite3
2324  libcdaudio          - ia32-libs <unfixable> (embed)
 grip  
 gnome-vfs (vfs2 as well?)  
2325    
2326    sysfsutils
2327            - ia32-libs <unfixable> (embed)
2328    
2329  fudforum:  tcp-wrappers
2330  phpgroupware-fudforum          - ia32-libs <unfixable> (embed)
 egroupware-fudforum  
2331    
2332    tdb
2333            - ia32-libs <unfixable> (embed)
2334    
2335  cvs:  tslib
2336  gcvs (at least an additional script is included, check if there's more)          - ia32-libs <unfixable> (embed)
2337    
2338  pcre:  unixodbc
2339  python          - ia32-libs <unfixable> (embed)
 php4 (src included, but Debian package links dynamically)  
2340    
2341    xaw3d
2342            - ia32-libs <unfixable> (embed)
2343    
2344  tiff:  xbitmaps
2345  wxpythongtk (check, which debian pkg this is in)          - ia32-libs <unfixable> (embed)
 older kdegraphics/kpdf releases < 3.3 embedded a copy  
2346    
2347  uudeview:  xcb-util
2348  libconvert-uulib-perl          - ia32-libs <unfixable> (embed)
2349    
2350  sqlite: (not affected by security vulnerabilities so far)  xcursor-themes
2351  amarok          - ia32-libs <unfixable> (embed)
2352    
2353  uudeview:  xft
2354  libconvert-uulib-perl          - ia32-libs <unfixable> (embed)

Legend:
Removed from v.1828  
changed lines
  Added in v.15825

  ViewVC Help
Powered by ViewVC 1.1.5