/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 2800 by jmm-guest, Sun Nov 20 21:22:41 2005 UTC revision 9036 by keescook-guest, Wed Jun 11 17:05:54 2008 UTC
# Line 1  Line 1 
1  This file collects cases, where a source package embeds code from  Embedded code copies
2  other projects, without linking dynamically:  ====================
   
 xpdf code: (some use xpdf 2, some xpdf 3)  
 gpdf  
 pdftohtml  
 kdegraphics/kpdf  
 tetex-bin  
 cupsys (only older releases, recent ones use xpdf-utils, it's still present in the src, though)  
 poppler  
   
 zlib code: (separate between 1.2 and 1.1)  
 dpkg  
 rsync  
 mozilla-firefox  
 mozilla(?)  
 Linux kernels  
 pvpgn (links dynamically since 1.7.8-2)  
   
   
 libgadu/ekg:  
 centericq  
 gaim  
 kopete (ships the code, but links dynamically in the Debian package)  
 kadu (not packaged in Debian)  
 GNU gadu (not packaged in Debian)  
   
   
 xmlrpc: (which package is the "origin" of this code?)  
 drupal  
 phpgroupware  
 egroupware  
 phpwiki  
 php4 (php-pear, IIRC this was reorganized some weeks ago?)  
 tikiwiki (not packaged in Debian)  
   
   
 shtool: (affects build-time only)  
 mysql-ocaml  
 php4  
   
   
 mozilla:  
 mozilla-firefox  
 mozilla-thunderbird  
 nvu  
   
   
 xli:  
 xloadimage  
   
   
 lesstif: (beware: two different lesstif APIs supported in one package, 1.2 discarded upstream)  
 openmotif  
 xfree86/xorg (in libxpm, still the case with x.org?  
   
   
 kerberized apps with BSD origin:  
 krb4  
 krb5  
 heimdal  
   
   
 grip: (which pkg is the origin?)  
 libcdaudio  
 grip  
 gnome-vfs (vfs2 as well?)  
   
   
 fudforum:  
 phpgroupware-fudforum  
 egroupware-fudforum  
   
 cvs:  
 gcvs (at least an additional script is included, check if there's more)  
   
 pcre:  
 python  
 php4 (src included, but Debian package links dynamically)  
 analog (src included, but Debian package links dynamically)  
 libgoffice-1  
 tf5 (since 5.0beta7 the Debian package links dynamically)  
   
 tiff:  
 wxpythongtk (check, which debian pkg this is in)  
 older kdegraphics/kpdf releases < 3.3 embedded a copy  
   
 uudeview:  
 libconvert-uulib-perl  
   
 sqlite: (not affected by security vulnerabilities so far)  
 amarok  
   
 uudeview:  
 libconvert-uulib-perl  
   
 util-linux/mount:  
 loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb  
   
 webmin:  
 usermin (they share at least a miniserv.pl mini web server)  
   
 sylpheed:  
 sylpheed-claws  
   
 phpsysinfo:  
 egroupware  
 phpgroupware  
   
 phpldapadmin:  
 egroupware  
3    
4    This file collects source packages that embed code from other projects.
5    This is considered bad for fixing security flaws because the fix needs
6    to be applied in multiple source packages.
7    
8    Format:
9    <srcpkg> (<optional comment about srcpkg>)
10            - <embedding srcpkg> <status> (<sort>; bug #<number>)
11            NOTE: optional comments about the linkage of the embedding srcpkg
12    
13    status: version number fixing the embedded copy, <unfixed>, <removed>,
14            <itp> or <unknown> if the version number can not be determined
15            <unfixable> for unavoidable cases (e.g., forks that add real value)
16    sort: static (linking statically against a lib)
17          embed (embedding a copy of the library into another source package)
18          fork (the package is not just embedding code but it is a fork and
19                thus might share parts of the source code)
20          old-version (the package is an older version of essentially
21                       the same code)
22    
23    The srcpkg might be some string to identify the code if there is no
24    specific source package.
25    
26    Everything up to the next line is ignored.
27    ---BEGIN
28    xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29            NOTE: Fixed packages link to poppler library unless otherwise noted
30            - gpdf <removed>
31            [sarge] - gpdf <unfixed>
32            NOTE: has been replaced by evince in etch
33            - pdftohtml <unknown>
34            [sarge] - pdftohtml <unfixed>
35            [etch] - pdftohtml <unfixed>
36            NOTE: has been replaced by poppler-utils
37            - kdegraphics <unfixed> (embed; bug #436164)
38            NOTE: the kpdf replacement in KDE 4 is using poppler
39            - texlive-base 3.0-12 (embed)
40            - texlive-bin 2007-1 (embed)
41            NOTE: links to poppler
42            - koffice <unfixed> (embed; bug #436163)
43            - libextractor 0.5.12-1 (embed)
44            NOTE: libextractor is using its own pdf decoder now
45            - libextractor 0.5.12-1 (embed)
46            - pdfkit.framework 0.8-4 (embed)
47            - ipe <unfixed> (embed)
48            NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
49            - ruby-gnome2 <unknown> (embed)
50            NOTE: copy only present in source but links to poppler
51    
52    ppmd
53            - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
54    
55    peercast
56            - gnome-peercast <unfixed> (embed)
57            NOTE: gnome-peercast may better be removed, see #466539
58    
59    silc-toolkit
60            - silc-client 1.1~beta6-1 (embed)
61    
62    dietlibc
63            - ccontrol 0.9.1+20071204-1 (static)
64    
65    libiax
66            - iaxmodem <unfixed> (embed)
67    
68    zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
69            - dpkg <unfixed> (embed)
70            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
71            - rsync <unfixed> (embed)
72            NOTE: somehow derived code base
73            - mono <unfixed> (embed)
74            TODO: check mozilla
75            - Linux kernels <unfixed> (embed)
76            - pvpgn 1.7.8-2 (embed)
77            - mrtg 2.12.2-1 (embed)
78            - rpm <unknown> (embed)
79            NOTE: pinged anibal since when rpm was fixed
80    
81    libbz2
82            - dpkg <unfixed> (static)
83    
84    ekg
85            - centericq <unfixed> (embed)
86            - gaim <unfixed> (embed)
87            - pigdin <unfixed> (embed)(links dynamically against libgadu)
88            - kopete 4:3.3.2-5 (embed)
89            - kadu <unfixed> (embed)
90            - gadu <unfixed> (embed)
91            NOTE: g/kadu not packaged in Debian yet
92    
93    xmlrpc (which package is the "origin" of this code?)
94            - drupal <unfixed> (embed)
95            - phpgroupware <unfixed> (embed)
96            - egroupware <unfixed> (embed)
97            - phpwiki (embed)
98            - php4 <unfixed> (embed)
99            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
100    
101    shtool (affects build-time only)
102            - mysql-ocaml <unfixed> (embed)
103            - php4 <unfixed> (embed)
104    
105    mozilla source code
106            - mozilla-firefox <unfixed> (embed)
107            - mozilla-thunderbird
108            - firefox <removed>
109            [etch] - firefox <unfixed> (embed)
110            - thunderbird <removed>
111            [etch] - thunderbird <unfixed> (embed)
112            - iceweasel <unfixed> (embed)
113            - iceape <unfixed> (embed)
114            - icedove <unfixed> (embed)
115            - xulrunner <unfixed> (embed)
116            - nvu <removed> (embed)
117    
118    xli
119            - xloadimage <unfixed> (embed)
120    
121    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
122            - openmotif <unfixed> (embed)
123            - xfree86/xorg <unfixed> (embed)
124            NOTE: in libxpm
125    
126    kerberized apps with BSD origin
127            - krb4 <unfixed> (embed)
128            - krb5 <unfixed> (embed)
129            - heimdal <unfixed> (embed)
130    
131    grip (which pkg is the origin?)
132            - libcdaudio
133            - grip
134            - gnome-vfs
135            TODO: check vfs2 as well
136    
137    fudforum
138            - phpgroupware-fudforum <unfixed> (embed)
139            - egroupware-fudforum <removed>
140            [sarge] - egroupware-fudforum <unfixed> (embed)
141    
142    cvs
143            - gcvs <unfixed> (embed)
144            NOTE: see cvsunix/src in tarball
145    
146    pcre
147            - python* <unfixed> (embed)
148            - php4 <unknown> (embed)
149            - analog 2:5.23-0woody1 (embed)
150            - libgoffice-1 <unfixed> (embed)
151            - vfu 4.06-4.1 (embed; bug #450754)
152            - tf5 5.0beta7-1 (embed)
153            - monotone <unfixed> (embed)
154            NOTE: this only affects versions >= 0.37
155            - glib <unfixed> (embed)
156            NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic
157            - apache2 2.0.53-4 (embed)
158            - exim4 4.10-0.srh20.12 (embed)
159            - yacas <unfixed> (embed)
160            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
161            - gtamsanalyzer.app 0.42-5 (embed)
162            - tin <unknown> (embed)
163            - kazehakase 0.5.2-1
164            - webkit <unfixed> (embed)
165            - qt4-x11 <unfixed> (embed)
166            NOTE: embedded via webkit copy
167    
168    tiff
169            - wxwindows2.4 2.2.1 (embed)
170    
171    uudeview
172            - libconvert-uulib-perl <unfixed> (embed)
173            - pan <unfixed> (embed)
174    
175    sqlite (not affected by security vulnerabilities so far)
176            - amarok <unfixed> (embed)
177            - monotone <unfixed> (embed)
178            - iceweasel <unfixed> (embed)
179    
180    util-linux/mount
181            - loop-aes-utils <unfixed> (embed)
182            NOTE: contains code from util-linux' mount in the mount-aes-udeb
183    
184    webmin
185            - usermin <unknown> (embed)
186            [sarge] - usermin <unfixed> (embed)
187    
188    sylpheed
189            - sylpheed-claws <unfixed> (fork)
190    
191    phpsysinfo
192            - egroupware <unfixed> (embed)
193            - phpgroupware <unfixed> (embed)
194    
195    phpldapadmin
196            [sarge] - egroupware <unfixed> (embed)
197            NOTE: removed from egroupware after sarge
198    
199    chmlib
200            - kchmviewer <unknown> (embed)
201    
202    libavcodec/libavformat (source: ffmpeg)
203            - mplayer <unfixed> (embed; bug #395252)
204            - xvidcap <unfixed> (embed)
205            - kino <unfixed> (static)
206            - vlc <unfixed> (static)
207            - smilutils <unfixed> (static)
208            - motion <unfixed> (static)
209            - gst-ffmpeg <unfixed> (embed)
210            - gstreamer0.10-ffmpeg <unfixed> (embed)
211            - xmovie <unfixed>
212            TODO: gimp-gap (potentially using ffmpeg code as well)
213    
214    mad MPEG decoding lib
215            - mad <unfixed> (embed)
216            - xine-lib <unfixed> (embed)
217    
218    libdts
219            - xine-lib <unfixed> (embed)
220    
221    flac
222            - xine-lib <unfixed> (embed)
223    
224    liba52
225            - a52dec <unfixed> (embed)
226            - xine-lib <unfixed> (embed)
227    
228    libmpeg2
229            - mpeg2dec <unfixed> (embed)
230            - xine-lib <unfixed> (embed)
231    
232    curl
233            - wget <unfixed> (embed)
234            NOTE: code for NTLM authentication
235    
236    uw-imap
237            - pine <unfixed> (embed)
238            - alpine <unfixed> (embed)
239    
240    imagemagick
241            - graphicsmagick <unfixed> (fork)
242    
243    halibut
244            - nsis <unfixed> (embed)
245    
246    libghttp
247            - hotway <unfixed> (embed)
248    
249    libsndfile
250            - ardour <unfixed> (embed)
251    
252    glibmm2.4
253            - ardour <unfixed> (embed)
254    
255    libgnomecanvasmm2.6
256            - ardour <unfixed> (embed)
257    
258    libsigc++-2.0
259            - ardour <unfixed> (embed)
260    
261    soundtouch
262            - ardour <unfixed> (embed)
263    
264    libmms
265            - xine-lib <unfixed> (embed)
266            - mimms <unfixed> (embed)
267    
268    fckeditor
269            - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
270            - moin <unfixed> (embed; bug #452599)
271            - karrigell <unfixed> (embed; bug #452598)
272            - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
273    
274    ipatlas (not packaged in Debian)
275            - moodle <unfixed> (embed)
276    
277    libphp-phpmailer
278            - moodle <unfixed> (embed)
279    
280    htmlArea (not packaged in Debian)
281            - moodle <unfixed> (embed)
282    
283    giflib:
284            - wine <unfixed> (embed; bug #466181)
285    
286    bennu (not packaged in Debian)
287            - moodle <unfixed> (embed)
288    
289    smarty:
290            - moodle <unfixed> (embed; bug #471158)
291            - gallery2 <unfixed> (embed; bug #471160)
292            - mahara 0.9.2-2 (embed; bug #471201)
293            - gosa 2.4beta1-1 (embed; bug #471200)
294    
295    TinyMCE
296            - wordpress <unfixed> (embed; bug #478257)
297            - moodle <unfixed> (embed)
298            - knowledgeroot <unfixed> (embed)
299            - joomla <itp> (bug #326398)
300    
301    scintilla
302            - scite <unfixed> (embed)
303            - qscintilla <unfixed> (embed)
304            - qscintilla2 <unfixed> (embed)
305            - geany <unfixed> (embed)
306    
307    libphp-adodb
308            - moodle <unfixed> (embed)
309            NOTE: also AdoDB-XML Schema
310            - gallery2 <unfixed> (embed)
311            - phppgadmin <unfixed> (embed)
312            - egroupware <unfixed> (embed)
313            - phpwiki <unfixed> (embed)
314            - ipplan <unfixed> (embed)
315            - typo3 <unfixed> (embed)
316            - moodle <unfixed> (embed)
317            - cacti <unknown> (embed)
318            [sarge] - cacti <unfixed> (embed)
319            NOTE: dependency exists, but internal version is used
320    
321    gzip
322            - linux-kernel <unfixed> (embed)
323            NOTE: lib/inflate.c
324            - klibc <unfixed> (embed)
325            NOTE: based on linux-kernel gzip code
326            - busybox <unfixed> (embed)
327    
328    neon
329            - cadaver <unfixed> (embed; bug #188381)
330            - gnome-vfs2 <unfixed> (embed; bug #395874)
331            - litmus <unfixed> (embed; #395875)
332            [sarge] - screem <unfixed> (embed)
333            - sitecopy <unfixed> (embed; bug #395876)
334            [etch] - tla <unfixed> (embed; bug #395877)
335            [sarge] - tla <unfixed> (embed; bug #395877)
336    
337    libmodplug
338            - gst-plugins-bad0.10 <unfixed> (embed)
339    
340    libvncserver
341            - vino <unfixed> (embed)
342    
343    putty
344            - filezilla <unfixed> (embed)
345    
346    tinyxml (not packaged in Debian)
347            - filezilla <unfixed>
348    
349    gv
350            - evince <unfixed> (embed)
351            NOTE: ps/ tree from gv 3.5.8
352            - evince-gtk <unfixed> (embed)
353            NOTE: not packaged in Debian
354    
355    libXbae
356            [etch] - libpawlib2-lesstif <unfixed> (embed)
357            NOTE: from Cernlib
358    
359    libXaw
360            [etch] - libpawlib2-lesstif
361            NOTE: from Cernlib
362            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
363    
364    libgd2
365            - graphviz <unfixed> (embed)
366            NOTE: lib/gd seems to be 2.0.33
367            - wml <unfixed> (embed)
368            NOTE: derived from gd 1.6.3
369    
370    rar
371            - unrar-nonfree <unfixed> (embed)
372    
373    unrar-free (maybe this code is derived from the original rar, too?)
374            - clamav <unfixed> (embed)
375            NOTE: seems to be disabled in default config
376    
377    mplayer (DirectMedia Object loader)
378            - xine-lib <unfixed> (embed)
379            NOTE: src/libw32dll/
380            - vlc <unfixed> (embed)
381            NOTE: modules/codec/dmo/
382    
383    libwpd (WordPerfect converter)
384            - openoffice.org <unfixed> (embed)
385    
386    fsplib (http://sourceforge.net/projects/fsp/)
387            - gftp <unfixed> (embed)
388            NOTE: lib/fsplib version 0.3
389    
390    librpcsecgss
391            - krb5 <unfixed> (embed)
392    
393    jasper
394            - ghostscript <unfixed> (embed)
395            - gs-gpl <unfixed> (embed)
396    
397    libidn
398            - monotone <unfixed> (embed)
399    
400    liblua
401            - monotone <unfixed> (embed)
402    
403    libbotan
404            - montone <unfixed> (embed)
405    
406    NetXX
407            - monotone <unfixed> (embed)
408    
409    libgc
410            - mono <unfixed> (embed)
411    
412    lzma
413            - p7zip <unfixed> (embed)
414    
415    lzo
416            - grub2 <unfixed> (embed)
417    
418    yassl
419            - mysql-dfsg-5.0 <unfixed> (embed)
420    
421    pax code
422            - tar <unfixed> (embed)
423            - cpio <unfixed> (embed)
424    
425    t1lib
426            - tetex-bin 2.0.2-1 (embed)
427            - texlive-bin <unknown> (embed)
428    
429    guichan
430            - boswars <unfixed> (embed)
431            NOTE: maintainer notified us, working on it
432    
433    tolua
434            - boswars <unfixed> (embed)
435            NOTE: maintainer notified us, working on it
436    
437    asio-dev
438            - luxrender <unfixed> (embed)
439            NOTE: maintainer notified us, working on it
440            NOTE: may be merged with boost "soon"
441    
442    xine-lib
443            - vlc <unfixed> (embed)
444            NOTE: only parts included in modules/access/rtsp
445    
446    netpbm
447            - tcl8.3 <unfixed> (embed)
448            - tcl8.4 <unfixed> (embed)
449            - tcl8.5 <unfixed> (embed)
450            NOTE: generic/tkImgGIF.c
451    
452    tk8.5
453            - tk8.0 <removed> (old-version)
454            - tk8.3 <unfixed> (old-version)
455            - tk8.4 <unfixed> (old-version)
456            - perl-tk <unfixable> (fork)
457    
458    samba
459            - mc <unfixed> (embed)
460            NOTE: maintainer is aware of this, currently searching a solution
461    
462    plib1.8.4c2
463            - boson <unfixed> (fork)
464            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
465    
466    fribidi
467            - quesoglc <unfixed> (embed)
468    
469    glew
470            - quesoglc <unfixed> (embed)
471    
472    minorGems
473            - transcend <unfixed> (embed)
474            - cultivation <unfixed> (embed)
475    
476    tar
477            - libarchive <unfixed> (embed)
478            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
479    
480    cpio
481            - libarchive <unfixed> (embed)
482            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
483    
484    webkit
485            - qt4-x11 <unfixed> (embed)
486    
487    ftgl
488            - blender 2.46+dfsg-1 (embed)
489    
490    wv
491            - abiword <unfixed>
492    
493    qemu
494            - kvm <unfixed> (embed)
495    
496    speex
497            - vorbis-tools <unfixed> (embed)
498            NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
499            - gst-plugins-good0.10 <unfixed> (embed)
500            - xine-lib <unfixed> (embed)
501            - libfishsound <unfixed> (embed)
502            - libannodex <unfixed> (embed)
503            - vlc <unfixed> (embed)
504            - xmms-speex <unfixed> (embed)
505            - libsdl-sound1.2 <unfixed> (embed)
506            - sweep <unfixed> (embed)
507    
508    libreadline
509            - magic <unfixed> (old-version)
510            NOTE: magic is currently an RFS
511    
512    opcode
513            - ode <unfixed> (embed)
514            NOTE: opcode is not a package in debian, it is just embedded
515            NOTE: http://www.codercorner.com/Opcode.htm
516    
517    gimpact
518            - ode <unfixed> (embed)
519            NOTE: gimpact is not a package in debian, it is just embedded
520            NOTE: http://gimpact.sf.net
521    
522    MochiKit.js
523            - mahara <unfixed> (embed)
524            - ntop <unfixed> (embed)
525            - python-oherence <unfixed> (embed)
526            - python-paste <unfixed> (embed)
527            - python-turbogears <unfixed> (embed)
528            - zope-plone3 <unfixed> (embed)
529    
530    prototype.js
531            - netbeans-ide <unfixed> (embed)
532            - auth2db-frontend <unfixed> (embed)
533            - citadel-webcit <unfixed> (embed)
534            - asterisk <unfixed> (embed)
535            - doc-iana <unfixed> (embed)
536            - libaws-doc <unfixed> (embed)
537            - libgettext-ruby-data <unfixed> (embed)
538            - libjson-ruby-doc <unfixed> (embed)
539            - liblucene2-java-doc <unfixed> (embed)
540            - libopenid-ruby <unfixed> (embed)
541            - solr-common <unfixed> (embed)
542            - glpi <unfixed> (embed)
543            - hobbix <unfixed> (embed)
544            - mnemo2 <unfixed> (embed)
545            - nag2 <unfixed> (embed)
546            - libjs-prototype <unfixed> (embed)
547            - libjs-scriptaculous <unfixed> (embed)
548            - knowledgeroot <unfixed> (embed)
549            - mediatomb-common <unfixed> (embed)
550            - mt-daapd <unfixed> (embed)
551            - op-panel <unfixed> (embed)
552            - ebug-http <unfixed> (embed)
553            - phpgedview <removed> (embed)
554            - poker-web <unfixed> (embed)
555            - python-webhelpers <unfixed> (embed)
556            - qwik <unfixed> (embed)
557            - rails <unfixed> (embed)
558            - typo3-src-4.1 <unfixed> (embed)
559            - wordpress <unfixed> (embed)
560            - zope-plone3 <unfixed> (embed)
561            - smokeping <unfixed> (embed)
562    
563    gdb
564            - insight <unfixed> (embed)

Legend:
Removed from v.2800  
changed lines
  Added in v.9036

  ViewVC Help
Powered by ViewVC 1.1.5