/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 3729 by micah, Sat Apr 1 22:59:42 2006 UTC revision 13647 by pabs, Sat Dec 26 01:55:34 2009 UTC
# Line 1  Line 1 
1    Embedded code copies
2    ====================
3    
4  This file collects cases, where a source package embeds code from  This file collects source packages that embed code from other projects.
5  other projects, without linking dynamically:  This is considered bad for fixing security flaws because the fix needs
6    to be applied in multiple source packages.
7    
8    Format:
9    <srcpkg> (<optional comment about srcpkg>)
10            - <embedding srcpkg> <status> (<sort>; bug #<number>)
11            NOTE: optional comments about the linkage of the embedding srcpkg
12    
13    status: version number fixing the embedded copy, <unfixed>, <removed>,
14            <itp>, <not-affected>, <unknown> if the version number can not
15            be determined, or <unfixable> for unavoidable cases (e.g., forks
16            that add real value)
17    sort: static (linking statically against a lib)
18          embed (embeds a copy of the library into another source package)
19          modified-embed (embeds a code copy that differs from upstream code)
20          fork (a full-blown fork of another source package)
21          old-version (an older version of essentially the same code)
22    
23    The srcpkg might be some string to identify the code if there is no
24    specific source package.
25    
26    Everything up to the next line is ignored.
27    ---BEGIN
28    xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29            NOTE: Fixed packages link to poppler library unless otherwise noted
30            - pdftohtml <unknown>
31            [sarge] - pdftohtml <unfixed>
32            [etch] - pdftohtml <unfixed>
33            NOTE: has been replaced by poppler-utils
34            - kdegraphics 4:4.2.2-1 (embed; bug #436164)
35            - texlive-base 3.0-12 (embed)
36            - texlive-bin 2007-1 (embed)
37            NOTE: links to poppler
38            - koffice <unfixed> (embed; bug #436163)
39            - libextractor 0.5.12-1 (embed)
40            NOTE: libextractor is using its own pdf decoder now
41            - ipe <unfixed> (embed)
42            NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
43            - ruby-gnome2 <unknown> (embed)
44            NOTE: copy only present in source but links to poppler
45            - pdfedit <unfixed> (embed; bug #510794)
46            - swftools <unfixed> (embed; bug #551293)
47            - poppler <unfixable> (fork)
48    
49    ppmd
50            - libcomplearn-mod-ppmd <unfixed> (fork)
51            NOTE: discussion in #458152
52    
53    libevent
54            - transmission 1.71-1 (embed; bug #529372)
55    
56    lrmi
57            - read-edid 2.0.0-1 (embed; bug #495131)
58            - s3switch <unfixed> (embed)
59            - xresprobe <unfixed> (embed)
60            - zhcon <unfixed> (embed)
61    
62    peercast
63            - gnome-peercast <removed> (embed)
64            [etch] - gnome-peercast <unfixed> (embed)
65    
66    silc-toolkit
67            - silc-client 1.1~beta6-1 (embed)
68    
69    icclib
70            - ghostscript <unfixed> (embed)
71            - argyll <unfixed> (embed)
72    
73    dietlibc
74            - ccontrol 0.9.1+20071204-1 (static)
75    
76    libmikmod
77            - sdl-mixer1.2 <unfixed> (embed)
78            TODO: report bug
79    
80    libiax
81            - iaxmodem <unfixable> (embed; bug #548885)
82    
83    spandsp
84            - iaxmodem <unfixable> (embed; bug #548885)
85    
86    zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
87            - dpkg <unfixed> (static)
88            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
89            - rsync <unfixed> (embed)
90            NOTE: somehow derived code base
91            - mono <unfixed> (embed)
92            TODO: check mozilla
93            - Linux kernels <unfixed> (embed)
94            - pvpgn 1.7.8-2 (embed)
95            - mrtg 2.12.2-1 (embed)
96            - rpm <unknown> (embed)
97            NOTE: pinged anibal since when rpm was fixed
98            - tuxcmd-modules <unfixed> (embed)
99            - zsync <unfixed>
100            - tra <unfixed>
101            - sash <unfixed>
102            - nsis <unfixed>
103            - mseide-msegui <unfixed>
104            NOTE: mseide
105            - mirrordir <unfixed>
106            - poco <unfixed>
107            - klibc <unfixed>
108            - ghostscript <unfixed>
109            - freeimage <unfixed>
110            - clamav <unfixed> (fork)
111            NOTE: from the changelog: "libclamav6 does indeed duplicate parts of the zlib code, but there is not way around that"
112            - tuxonice-userui <unfixed>
113            - plt-scheme <unfixed>
114            - perl <unfixed>
115            - paraview <unfixed>
116            - gcvs <unfixed>
117            - dump <unfixed>
118            - aide <unfixed> (static)
119            - dar <unfixed> (static)
120            - avfs <unfixed>
121            - fpc <unfixed>
122            - winff <unfixed>
123            NOTE: inherited from fpc, see #472304
124            - lazarus <unfixed>
125            NOTE: inherited from fpc, see #472304
126            - erlang <unfixed> (embed)
127            - gamera 3.2.3-1 (embed)
128            - python2.4 <unfixed> (embed; bug #553403)
129            - python2.5 <unfixed> (embed; bug #553403)
130    
131    dulwich
132            - hg-git 0.1.0-1 (embed; bug #541996)
133    
134    libvigraimpex
135            - hugin <unfixed> (embed; bug #542259)
136            - enblend-enfuse <unfixed> (embed; bug #542258)
137            - gamera 3.2.3-1 (embed)
138    
139    libbz2
140            - dpkg <unfixed> (static)
141    
142    libgadu
143            - centerim <unfixed> (embed; bug #559783)
144            - pidgin <not-affected> (links dynamically since initial release; fixed in gaim)
145            - gaim 1:2.0.0+beta3-3 (embed; bug #360280)
146            - kdenetwork 4:3.3.2-5 (embed)
147            NOTE: from kdenetwork: kopete
148            - ekg 1:1.8~rc0-1 (embed)
149            - kadu 0.6.0.2-3 (embed; bug #504430)
150            - gadu <itp> (embed)
151    
152    xmlrpc (which package is the "origin" of this code?)
153            - drupal <unfixed> (embed)
154            - phpgroupware <unfixed> (embed)
155            - egroupware <unfixed> (embed)
156            - phpwiki <unfixed> (embed)
157            - php4 <unfixed> (embed)
158            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
159    
160    shtool (affects build-time only)
161            - mysql-ocaml <unfixed> (embed)
162            - php4 <unfixed> (embed)
163    
164    xulrunner
165            - iceape <unfixed> (embed; bug #561749)
166            - iceweasel 2.0.0.19 (embed)
167            - icedove <unfixed> (embed; bug #561750)
168            - kompozer <unfixed> (embed; bug #532168)
169            - galeon 2.0.2-4 (embed)
170            - epiphany-browser 2.14.3-8 (embed)
171            - conkeror 0.9~git080629-2 (embed)
172            - kazehakase 0.4.2-1 (embed)
173    
174    xli
175            - xloadimage <unfixed> (embed)
176    
177    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
178            - openmotif <unfixed> (embed)
179            - libxpm <unfixed> (embed)
180    
181    kerberized apps with BSD origin
182            - krb4 <removed> (embed)
183            - krb5 <unfixed> (embed)
184            - heimdal <unfixed> (embed)
185    
186    grip (which pkg is the origin?)
187            - libcdaudio <unfixed>
188            - grip <unfixed>
189            - gnome-vfs <unfixed>
190            TODO: check vfs2 as well
191    
192    fudforum
193            [etch] - phpgroupware <unfixed> (embed)
194            NOTE: phpgroupware-fudforum
195            [sarge] - egroupware-fudforum <removed> (embed)
196    
197    libbsd
198            - rdate 1:1.2-3 (embed)
199            - atheme-services <unfixed>
200            - libbsd-arc4random-perl <unfixed>
201            - isakmpd <unfixed>
202            - bsdgames <unfixed> (embed)
203            - bsd-mailx <unfixed> (embed)
204            - netcat-openbsd <unfixed> (embed; bug #550611)
205            - openssh <unfixed> (embed)
206            - unworkable <unfixed> (embed)
207    
208    cvs
209            - gcvs <unfixed> (embed)
210            NOTE: see cvsunix/src in tarball
211    
212    pcre3
213            - php4 <unknown> (embed)
214            - analog 2:5.23-0woody1 (embed)
215            - goffice <unfixed> (embed)
216            NOTE: libgoffice-*
217            - vfu 4.06-4.1 (embed; bug #450754)
218            - tf5 5.0beta7-1 (embed)
219            - monotone 0.43-1 (embed)
220            NOTE: this only affects versions >= 0.37
221            - glib2.0 2.15.2-1 (embed)
222            - apache2 2.0.53-4 (embed)
223            - exim4 4.10-0.srh20.12 (embed)
224            - yacas <unfixed> (embed)
225            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
226            - gtamsanalyzer.app 0.42-5 (embed)
227            - tin 980117-1 (embed)
228            - kazehakase 0.5.2-1
229            - webkit 1.0.1-1 (embed)
230            - qt4-x11 <unfixed> (embed)
231            NOTE: embedded via webkit copy
232            - erlang <unfixed> (embed)
233    
234    tiff
235            - wxwindows2.4 2.2.1 (embed)
236            - gamera 3.2.3-1 (embed)
237    
238    uudeview
239            - libconvert-uulib-perl <unfixed> (embed)
240            - pan <unfixed> (embed)
241    
242    sqlite (not affected by security vulnerabilities so far)
243            - amarok <unfixed> (embed)
244            - monotone 0.43-1 (embed)
245            - iceweasel <unfixed> (embed)
246            - heimdal <unfixed> (embed; bug #559616)
247    
248    util-linux/mount
249            - loop-aes-utils <unfixed> (embed)
250            NOTE: contains code from util-linux' mount in the mount-aes-udeb
251    
252    sylpheed
253            - sylpheed-claws <unfixed> (fork)
254    
255    phpsysinfo
256            - egroupware <unfixed> (embed)
257            - phpgroupware <unfixed> (embed)
258    
259    phpldapadmin
260            [sarge] - egroupware <unfixed> (embed)
261            NOTE: removed from egroupware after sarge
262    
263    chmlib
264            - kchmviewer <unknown> (embed)
265    
266    ffmpeg (libavcodec/libavformat)
267            - mplayer 1.0~rc2-14 (embed; bug #395252)
268            - kino 1.0.0-1
269            - vlc <not-affected> (Links dynamically since initial release)
270            - smilutils 0.3.0-10
271            NOTE: smilutils likely fixed earlier, marking Etch's version as fixed
272            - motion 3.1.19-1
273            - gstreamer0.10-ffmpeg 0.10.3-2
274            - xmovie <removed> (static)
275            TODO: gimp-gap (potentially using ffmpeg code as well)
276            - avifile 1:0.7.48~20090503.ds-1 (embed; bug #538750)
277            - audacity 1.3.7-2 (embed; bug #512278)
278    
279    faad2
280            - mplayer 1.0~rc2-20 (embed)
281            - avifile <unfixed> (embed; bug #538750)
282            - ffmpeg-debian <removed> (old-version)
283    
284    libmad (MPEG decoding lib)
285            - xine-lib <unfixed> (embed)
286            - avifile 1:0.7.48~20090503.ds-1 (embed) [./plugins/libmad/*]
287            TODO: check ocaml-mad, madplay, pymad, xmms-mad, xmms2
288    
 xpdf code: (some use xpdf 2, some xpdf 3)  
 gpdf (will be replaced by evince in Gnome 2.12)  
 pdftohtml (current poppler source package has a ported version, pinged maintainer)  
 kdegraphics/kpdf (upstream is working on using poppler, probably not in time for Etch)  
 tetex-bin (links to poppler since 3.0-12)  
 cupsys (only older releases, recent ones use xpdf-utils, it's still present in the src, though)  
 poppler  
 koffice (upstream is working on using poppler, probably not in time for Etch)  
 libextractor  
 pdfkit.framework (links to poppler since 0.8-4)  
   
 zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  
 dpkg  
 rsync (somehow derived code base)  
 mozilla(?)  
 Linux kernels  
 pvpgn (links dynamically since 1.7.8-2)  
 mrtg (links dynamically since 2.12.2-1)  
   
 libgadu/ekg:  
 centericq  
 gaim  
 kopete (ships the code, but links dynamically in the Debian package)  
 kadu (not packaged in Debian)  
 GNU gadu (not yet packaged in Debian)  
   
   
 xmlrpc: (which package is the "origin" of this code?)  
 drupal  
 phpgroupware  
 egroupware  
 phpwiki  
 php4 (php-pear, IIRC this was reorganized some weeks ago?)  
 tikiwiki (not packaged in Debian)  
   
   
 shtool: (affects build-time only)  
 mysql-ocaml  
 php4  
   
   
 mozilla:  
 mozilla-firefox  
 mozilla-thunderbird  
 nvu  
   
   
 xli:  
 xloadimage  
   
   
 lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)  
 openmotif  
 xfree86/xorg (in libxpm)  
   
   
 kerberized apps with BSD origin:  
 krb4  
 krb5  
 heimdal  
   
   
 grip: (which pkg is the origin?)  
 libcdaudio  
 grip  
 gnome-vfs (vfs2 as well?)  
   
   
 fudforum:  
 phpgroupware-fudforum  
 egroupware-fudforum  
   
 cvs:  
 gcvs (at least an additional script is included, check if there's more)  
   
 pcre:  
 all pythons  
 php4 (src included, but Debian package links dynamically)  
 analog (src included, but Debian package links dynamically)  
 libgoffice-1  
 tf5 (since 5.0beta7 the Debian package links dynamically)  
   
 tiff:  
 wxpythongtk (check, which debian pkg this is in)  
 older kdegraphics/kpdf releases < 3.3 embedded a copy  
   
   
 uudeview:  
 libconvert-uulib-perl  
   
 sqlite: (not affected by security vulnerabilities so far)  
 amarok  
   
 util-linux/mount:  
 loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb  
   
 webmin:  
 usermin  
   
 sylpheed:  
 sylpheed-claws  
   
 phpsysinfo:  
 egroupware  
 phpgroupware  
   
 phpldapadmin:  
 egroupware  
   
 chmlib:  
 kchmviewer (not packaged in Debian)  
   
 libavcodec/libavformat:  
 ffmpeg  
 xine-lib  
 xvidcap (currently in NEW)  
 kino (links statically, does not include code)  
 vlc (links statically, does not include code)  
 smilutils (links statically, does not include code)  
 motion (links statically, does not include code)  
 gst-ffmpeg  
 xmovie (currently in NEW)  
 gst-ffmpeg  
   
 mad MPEG decoding lib:  
 mad  
 xine-lib  
   
 libdts:  
289  libdts  libdts
290  xine-lib          - xine-lib <unfixed> (embed)
291    
 flac:  
292  flac  flac
293  xine-lib          - xine-lib <unfixed> (embed)
   
 liba52:  
 a52dec  
 xine-lib  
   
 libmpeg2:  
 mpeg2dec  
 xine-lib  
294    
295  curl:  liba52
296  wget (code for NTLM authentication)          - a52dec <unfixed> (embed)
297            - xine-lib <unfixed> (embed)
298    
299    libmpeg2
300            - mpeg2dec <unfixed> (embed)
301            - xine-lib <unfixed> (embed)
302    
303    libntlm
304            - wget <unfixed> (fork; bug #550436)
305            - curl <unfixed> (fork; bug #550437)
306            - cntlm <unfixed> (fork; bug #550438)
307    
308    uw-imap
309            - pine <unfixed> (embed)
310            - alpine <unfixed> (embed)
311    
312    imagemagick
313            - graphicsmagick <unfixed> (fork)
314    
315    python-urlgrabber
316            - mercurial <unfixed> (embed; bug #531062)
317            - w3af <unfixed> (embed; bug #555372)
318            [experimental] - harvestman <unfixed> (embed; bug #555373)
319    
320    beautifulsoup
321            - python-mechanize <unfixed> (embed; bug #555349)
322            - zope2.11 <unfixed> (embed; bug #555350)
323            - twill <unknown> (embed)
324    
325    halibut
326            - nsis <unfixed> (fork)
327    
328    libghttp
329            - hotway <unfixed> (embed)
330    
331    libsndfile
332            - ardour 1:2.7.1-1 (embed)
333    
334    glibmm2.4
335            - ardour 1:2.7.1-1 (embed)
336    
337    libgnomecanvasmm2.6
338            - ardour 1:2.7.1-1 (embed)
339    
340    libsigc++-2.0
341            - ardour 1:2.7.1-1 (embed)
342    
343    soundtouch
344            - ardour 1:2.7.1-1 (embed)
345    
346    libmms
347            - xine-lib <unfixed> (embed)
348            - mimms <unfixed> (embed)
349    
350    fckeditor
351            - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
352            - moin 1.8.2-2 (embed; bug #452599)
353            - karrigell <removed> (embed; bug #452598)
354            - gforge 4.6.99+svn6225-1 (embed)
355            - request-tracker3.8 <unfixed> (embed)
356    
357    ipatlas (not packaged in Debian)
358            - moodle <unfixed> (embed; bug #507185)
359    
360    libphp-phpmailer
361            - moodle <unfixed> (embed; bug #507185)
362            - mahara <unfixed> (embed)
363            - symfony <unfixed> (embed)
364            [etch] - phpgroupware <unfixed> (embed)
365            NOTE: phpgroupware-felamimail is only in etch
366            - egroupware <unfixed> (embed; bug #504283)
367            - glpi <unfixed>
368    
369    htmlArea (not packaged in Debian)
370            - moodle <unfixed> (embed)
371    
372    giflib
373            - wine <unfixed> (embed; bug #466181)
374    
375    bennu (not packaged in Debian, http://bennu.sourceforge.net)
376            - moodle <unfixed> (embed)
377    
378    smarty
379            - moodle 1.8.2-2 (embed; bug #471158)
380            - gallery2 2.2.5-2 (embed; bug #471160)
381            - mahara 0.9.2-2 (embed; bug #471201)
382            - gosa 2.4beta1-1 (embed; bug #471200)
383    
384    TinyMCE
385            - wordpress 2.5.1-3 (embed; bug #478257)
386            - moodle <unfixed> (embed; bug #507185)
387            - knowledgeroot <unfixed> (embed)
388            - joomla <itp> (bug #326398)
389    
390    scintilla (upstream provides static lib, rejected shared lib http://sf.net/support/tracker.php?aid=2488121)
391            - scite <unfixed> (embed)
392            - qscintilla <unfixed> (embed)
393            - qscintilla2 <unfixed> (embed)
394            - geany <unfixed> (fork)
395            - anjuta <unfixed> (embed)
396    
397    libphp-adodb
398            - moodle <unfixed> (embed; bug #507185)
399            NOTE: also AdoDB-XML Schema
400            - gallery2 <unfixed> (embed)
401            - phppgadmin <unfixed> (embed)
402            - egroupware <unfixed> (embed)
403            - phpwiki <unfixed> (embed)
404            - torrentflux 2.0beta1-2 (embed)
405            - ipplan <unfixed> (embed)
406            - typo3-src <unfixed> (embed)
407            - cacti <unknown> (embed)
408            [sarge] - cacti <unfixed> (embed)
409            NOTE: dependency exists, but internal version is used
410            - gforge 4.7~rc2-6 (embed)
411            - mahara <unfixed> (embed)
412    
413    gzip
414            - linux-kernel <unfixed> (embed)
415            NOTE: lib/inflate.c
416            - klibc <unfixed> (embed)
417            NOTE: based on linux-kernel gzip code
418            - busybox <unfixed> (embed)
419    
420    neon
421            - cadaver 0.22.3+debian-1 (embed; bug #188381)
422            - gnome-vfs2 <unfixed> (embed; bug #395874)
423            [etch] - litmus <unfixed> (embed; #395875)
424            - litmus <removed> (embed; #395875)
425            [sarge] - screem <unfixed> (embed)
426            - sitecopy 1:0.16.0-1 (embed; bug #395876)
427            [etch] - tla <unfixed> (embed; bug #395877)
428            [sarge] - tla <unfixed> (embed; bug #395877)
429    
430    libmodplug
431            - gst-plugins-bad0.10 <unfixed> (embed)
432    
433    libvncserver
434            - vino <unfixed> (embed)
435    
436    putty
437            - filezilla <unfixed> (embed)
438    
439    tinyxml (not packaged in Debian; itp bug #531968)
440            - filezilla <unfixed>
441            - crystalspace <unfixed> (embed)
442            - libwfut <unfixed> (embed)
443            - rarian <unfixed> (embed)
444            - bulletml <unfixed> (embed)
445            - pokerth <unfixed> (embed)
446            - qutecom <unfixed> (embed)
447            - sofa-framework <unfixed> (embed)
448            - yate <unfixed> (embed)
449            - antigrav <unfixed> (embed)
450            - balder2d <unfixed> (embed)
451            - cal3d <unfixed> (embed)
452            - criticalmass <unfixed> (embed)
453            - ember <unfixed> (embed)
454            - epiphany <unfixed> (embed)
455            - gambit <unfixed> (embed)
456            - noiz2sa <unfixed> (embed)
457            - ogre <unfixed> (embed)
458            - opencity <unfixed> (embed)
459            - openmovieeditor <unfixed> (embed)
460            - pouetchess <unfixed> (embed)
461            - tecnoballz <unfixed> (embed)
462            - trigger-rally <unfixed> (embed)
463            - xmoto <unfixed> (embed)
464            - mapnik <unknown> (embed)
465            NOTE: uses a different XML parser by default
466            - rrootage 0.23a-6 <embed>
467            NOTE: links to libbulltetml
468            - boson <unknown> (embed)
469            NOTE: the embedded code is unused
470    
471    gv
472            - evince <unfixed> (embed)
473            NOTE: ps/ tree from gv 3.5.8
474            NOTE: evince-gtk is affected (a component of evince source package)
475    
476    libXbae
477            - paw <removed> (embed)
478            [etch] - paw <unfixed> (embed)
479    
480    libgtkhtml
481            - claws-mail-extra-plugins <unfixed> (fork)
482    
483    libXaw
484            - paw <removed> (embed)
485            [etch] - paw <unfixed> (embed)
486            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
487    
488    libgd2
489            - graphviz <unfixed> (embed)
490            NOTE: lib/gd seems to be 2.0.33
491            - wml <unfixed> (embed)
492            - libwmf <unfixed> (embed)
493            NOTE: derived from gd 1.6.3
494    
495    rar
496            - unrar-nonfree <unfixed> (embed)
497    
498    unrar-free (maybe this code is derived from the original rar, too?)
499            - clamav <unfixed> (embed)
500            NOTE: seems to be disabled in default config
501    
502    mplayer (DirectMedia Object loader)
503            - xine-lib <unfixed> (embed)
504            NOTE: src/libw32dll/
505            - vlc <unfixed> (embed)
506            NOTE: modules/codec/dmo/
507            - mplayer 1.0~rc2-20 (embed)
508    
509    libwpd (WordPerfect converter)
510            - openoffice.org <unfixed> (embed)
511    
512    fsplib (http://sourceforge.net/projects/fsp/)
513            - gftp <unfixed> (embed)
514            NOTE: lib/fsplib version 0.3
515    
516    sprng
517            - tree-puzzle <unfixed> (embed)
518    
519    librpcsecgss
520            - krb5 <unfixed> (embed)
521    
522    jasper
523            - ghostscript 8.64~dfsg-2 (embed)
524    
525    libiris
526            - psi <unfixed> (embed)
527            - kdenetwork <unfixed> (embed)
528            NOTE: kopete embeds libiris but links dynamically to libidn
529            - kdegames <unfixed> (embed)
530            NOTE: ksirk/kde4
531    
532    libidn
533            - monotone 0.43-1 (embed)
534            - psi <unfixed> (embed)
535            NOTE: psi embeds libiris which embeds libidn
536            - kdegames <unfixed> (embed)
537            NOTE: kdegames/kde4 embeds libiris which embeds libidn
538    
539    liblua
540            - monotone 0.43-1 (embed)
541            - nmap 5.00-1 (embed; bug #527997)
542            [lenny] - nmap <unfixed> (embed; bug #527997)
543            - ocropus <unfixed> (embed)
544            - enigma <unfixed> (embed)
545            NOTE: requires lua built with C++
546            - freeciv <unfixed> (embed)
547    
548    libbotan
549            - monotone 0.43-1 (embed)
550    
551    NetXX
552            - monotone 0.43-1 (embed)
553    
554    libgc
555            - mono <unfixed> (embed)
556    
557    lzma
558            - p7zip <unfixed> (embed)
559            - xz-utils <unfixed> (fork)
560    
561    lzo
562            - grub2 <unfixed> (embed)
563    
564    yassl
565            - mysql-dfsg-5.0 <unfixed> (embed)
566    
567    pax code
568            - tar <unfixed> (embed)
569            - cpio <unfixed> (embed)
570    
571    t1lib
572            - tetex-bin 2.0.2-1 (embed)
573            - texlive-bin <unknown> (embed)
574    
575    guichan
576            - boswars <unfixed> (embed)
577            NOTE: maintainer notified us, working on it
578    
579    tolua
580            - boswars <unfixed> (embed)
581            NOTE: maintainer notified us, working on it
582            NOTE: actually tolua++
583            - ocropus <unfixed> (embed)
584            NOTE: actually tolua++
585            - freeciv <unfixed> (embed)
586            NOTE: actually tolua++
587            - enigma <unfixed> (embed)
588    
589  TODO evaluate:  asio-dev
590  gimp-gap (potentially using ffmpeg code as well)          - luxrender <removed> (embed)
591    
592  uw-imap:  xine-lib
593  pine          - vlc <unfixed> (embed)
594            NOTE: only parts included in modules/access/rtsp
 imagemagick:  
 graphicsmagick  
595    
596  halibut:  netpbm
597  nsis          - tcl8.3 <unfixed> (embed)
598            - tcl8.4 <unfixed> (embed)
599            - tcl8.5 <unfixed> (embed)
600            NOTE: generic/tkImgGIF.c
601    
602    tk8.5
603            - tk8.0 <removed> (old-version)
604            - tk8.3 <unfixed> (old-version)
605            - tk8.4 <unfixed> (old-version)
606            - perl-tk <unfixable> (fork)
607    
608    samba
609            - mc 2:4.6.2~git20080311-1 (embed)
610            NOTE: maintainer is aware of this, currently searching a solution
611    
612    plib1.8.4c2
613            - boson <unfixed> (fork)
614            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
615    
616    fribidi
617            - quesoglc <unfixed> (embed)
618            NOTE: compiled against system fribidi in Debian - embed only used when fribidi is not available on the system
619    
620    glew
621            - quesoglc <unfixed> (embed; bug #489341)
622            NOTE: waiting on GLEW_MX version of glew (see bug #474488)
623            - trigger <unfixed> (embed)
624            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
625            - trigger-rally <unfixed> (embed)
626            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
627    
628    minorGems (pabs contacted upstream about shared lib, he considers minorGems an 'ever-evolving collection of reusable code fragments' for his own use)
629            - transcend <unfixed> (embed)
630            - cultivation <unfixed> (embed)
631            - passage <unfixed> (embed)
632            - gravitation <unfixed> (embed)
633    
634    tar
635            - libarchive <unfixed> (embed)
636            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
637    
638    cpio
639            - libarchive <unfixed> (embed)
640            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
641    
642    webkit
643            - qt4-x11 <unfixed> (embed; bug #479851)
644            - kdelibs <unfixed> (old-version)
645            - kde4libs <unfixed> (fork)
646    
647    ftgl
648            - blender 2.46+dfsg-1 (embed)
649    
650    wv
651            - abiword <unfixed>
652    
653    qemu
654            - kvm <unfixed> (embed; bug #543159)
655            NOTE: the kvm package will be removed from sid and squeeze soon (after
656            NOTE: which it will only be in experimental). superceded by qemu-kvm.
657            - qemu-kvm <unfixed> (embed; bug #560853)
658            - xen-3 3.4.2-2 (embed; bug #560856)
659            - xen-unstable <unfixed> (embed; bug #560856)
660    
661    vgabios
662            - kvm <unfixed> (embed; bug #489442)
663    
664    bochs
665            - kvm <unfixed> (embed; bug #489442)
666    
667    speex
668            - vorbis-tools <unfixed> (embed)
669            NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
670            - gst-plugins-good0.10 <unfixed> (embed)
671            - xine-lib <unfixed> (embed)
672            - libfishsound <unfixed> (embed)
673            - libannodex <removed> (embed)
674            - vlc <unfixed> (embed)
675            - xmms-speex <unfixed> (embed)
676            - libsdl-sound1.2 <unfixed> (embed)
677            - sweep <unfixed> (embed)
678    
679    libreadline
680            - magic <itp> (old-version)
681    
682    opcode
683            - ode <unfixed> (embed)
684            NOTE: opcode is not a package in debian, it is just embedded
685            NOTE: http://www.codercorner.com/Opcode.htm
686    
687    gimpact
688            - ode <unfixed> (embed)
689            NOTE: gimpact is not a package in debian, it is just embedded
690            NOTE: http://gimpact.sf.net
691    
692    mochikit
693            - mahara <unfixed> (embed)
694            NOTE: they require extra patches, still unmerged upstream
695            - ntop <unfixed> (embed)
696            - coherence 0.6.2-1 (embed)
697            - paste <unfixed> (embed)
698            - turbogears <unfixed> (embed)
699            - plone3 <unfixed> (embed)
700            - xulrunner <unfixed> (embed)
701            - libjifty-plugin-chart-perl <unfixed> (embed)
702            - sabnzbdplus <unfixed> (embed)
703            - tgmochikit <unfixed> (embed)
704    
705    prototypejs
706            - netbeans-ide 6.0.1+dfsg-2 (embed)
707            - auth2db 0.2.5-2+dfsg-1 (embed; bug #555218)
708            - webcit <unfixed> (embed; bug #555219)
709            - asterisk 1:1.6.2.0~rc3-1 (embed)
710            - libjson-ruby 1.1.4-1 (embed; bug #555224)
711            - lucene2 2.9.1+ds1-2 (embed; bug #555226)
712            - horde3 <unfixed> (embed)
713            - knowledgeroot <unfixed> (embed; bug #555230)
714            - mediatomb <unfixed> (embed; bug #555233)
715            - mt-daapd 0.9~r1696.dfsg-6lenny2 (embed)
716            - ebug-http <unfixed> (embed; bug #555236)
717            - libaws 2.7-1 (embed; bug #555222)
718            - phpgedview <removed> (embed)
719            - poker-network <unfixed> (embed; bug #555238)
720            - rails 2.1.0-6 (embed)
721            - wordpress 2.5.0-2 (embed; bug #555243)
722            - zope <not-affected> (the prototypejs embed is not in any of the obvious zope packages, e.g. zope2.9, zope2.10, zope2.11, and zope3)
723            TODO: search through all of the other zope packages
724            - ampache 3.4.1-2 (embed)
725            - exaile 0.2.14+debian-2.1 (embed; bug #555245)
726            - hobix 0.5~svn20070319-4 (embed; bug #555247)
727            - zabbix 1.6.6-4 (embed; bug #555250)
728            - chora2 <unfixed> (embed; bug #555253)
729            - gollem <unfixed> (embed; bug # 555254)
730            - jscropperui 1.2.1-1 (embed; bug #555257)
731            - scriptaculous <not-affected> (uses system prototype.js since initial upload; bug #555260)
732            - ingo1 <unfixed> (embed; bug #555261)
733            - kronolith2 <unfixed> (embed; bug #555262)
734            - activeldap <unfixed> (embed)
735            - libv8 <not-affected> (contains a google-specific implementation of prototype.js)
736            - mantis <unfixed> (embed; bug #555265)
737            - otrs2 2.3.4-6 (embed; bug #555267)
738            - webcalendar <unfixed> (embed; bug #555269)
739            - redmine 0.9.0~svn2907-1 (embed; bug #555270)
740            - jifty 0.90519-1 (embed; bug #555271)
741            - jquery <unfixed> (embed; bug #555272)
742            - passenger 2.2.5debian1-1 (embed; bug #555273)
743            - plone3 <unfixed> (embed; bug #555275)
744            - wesnoth <not-affected> (prototype.js not included in any of the binary packages; bug #555277)
745            - libhtml-prototype-perl 1.48-3 (embed; bug #538920)
746            - xulrunner <unfixed> (embed)
747            NOTE: included in iceweasel/xulrunner unit tests directory, so may not be security-relevant
748    
749    gdb
750            - insight <unfixed> (embed)
751    
752    e2fsprogs
753            - ldiskfsprogs <unfixable> (fork)
754    
755    quazip (not packaged in Debian)
756            - qcake <unfixed> (embed)
757            NOTE: starting with upstream version 0.6.4
758    
759    exo
760            - pcmanfm <unfixed> (embed; bug #499677)
761            NOTE: slightly modified source code
762    
763    java
764            - openjdk-6 <unfixed>
765            - sun-java5 <unfixed>
766            - sun-java6 <unfixed>
767    
768    libphp-snoopy
769            - ampache 3.4.1-2 (embed; bug #504169)
770            - gforge 4.6.99+svn6094-2 (embed)
771            - mahara 1.0.5-2 (embed; bug #504170)
772            - pixelpost 1.7.1-5 (embed; bug #504171)
773            - mediamate 0.9.3.6-5 (embed; bug #504172)
774            - opendb <removed> (embed; bug #504173)
775            [etch] - opendb <unfixed> (embed; bug #504173)
776            - wordpress 2.5.1-9 (embed; bug #443948)
777            - moodle <unfixed> (embed; bug #507185)
778            [etch] - phpgroupware <unfixed> (embed)
779            NOTE: phpgroupware-felamimail
780            - magpierss 0.72-3 (embed; bug #431089)
781    
782    jquery
783            - zekr <unfixed> (embed)
784            - wordpress <unknown> (embed)
785            - yocto-reader <unfixed> (embed)
786            - textpattern <unfixed> (embed)
787            - genshi 0.5.1-1 (embed)
788            NOTE: compressed file under examples/ dir
789            - prewikka <unfixed> (embed)
790            - libramaze-ruby <unfixed> (embed)
791            - drupal5 <unfixed> (embed)
792            - b2evolution <unfixed> (embed)
793            - wesnoth <unfixed> (embed)
794    
795    tablesorter (jquery plugin, not packaged yet)
796            - wesnoth <unfixed> (embed)
797    
798    kses
799            - wordpress <unfixed> (embed; bug #504242)
800            NOTE: their copy has all methods renamed to wp_<foo>
801            NOTE: kses isn't in Debian, RFP: #504240
802            - moodle <unfixed> (embed; bug #507185)
803            - egroupware <unfixed> (embed)
804    
805    magpierss
806            - wordpress <unfixed> (embed; bug #504242)
807            - moodle <unfixed>
808    
809    php-gettext
810            - wordpress 2.8.4-1 (embed; bug #504242)
811    
812    libphp-ixr (name may change, it is the Incutio XML-RPC)
813            - wordpress <unfixed> (embed; bug #504242)
814            NOTE: libphp-ixr isn't in Debian, RFP: #504236
815            - dokuwiki <unfixed> (embed)
816            - textpattern <unfixed> (embed)
817    
818    libphp-cas
819            - glpi <unfixed> (embed)
820            - moodle <unfixed> (embed; bug #505984)
821    
822    scriptaculous (prototype.js is among the embeds in the following)
823            - glpi <unfixed> (embed)
824            - libaws <unfixed> (embed; bug #555222)
825            - op-panel <unfixed> (embed)
826            - symfony <unfixed> (embed)
827            NOTE: maintainer says there are extra incompatible changes required
828            - pixelpost 1.7.1-6 (embed)
829            - webhelpers <unfixed> (embed)
830            - qwik <removed> (embed; bug #555241)
831            - smokeping <unfixed> (embed)
832            - turba2 <unfixed> (embed)
833            - typo3-src 4.2.3-1 (embed)
834            - request-tracker3.6 <unfixed> (embed)
835            - request-tracker3.8 <unfixed> (embed)
836            - rt-extension-emailcompletion <not-affected> (prototype.js not included in the binary package)
837            - wordpress 2.5.0-2 (embed)
838            - libhtml-prototype-perl 1.48-3 (embed)
839    
840    libmarkdown-php
841            - moodle <unfixed> (embed; bug #507185)
842            - pixelpost 1.7.1-6 (embed)
843    
844    php-openid
845            - wordpress-openid <itp> (embed)
846    
847    geshi
848            - dokuwiki 0.0.20080505-3.1 (embed)
849            - pgfouine 1.0-1.1 (embed)
850            - websvn 2.1.0-1 (embed)
851    
852    webcalendar
853            - gforge 4.7~rc2-6 (embed; bug #504758)
854    
855    libical
856            - kdepim <unfixed> (fork)
857            - kdepimlibs <unfixed> (fork)
858            NOTE: fixed in KDE4 post 4.1.x series
859            - claws-mail-extra-plugins <unfixed> (fork)
860    
861    libltdl3
862            - kdelibs <unfixed> (embed)
863            NOTE: it's been said it sets RT_GLOBAL (or something like that) at runtime and version in experimental of libltdl can optionally set it
864            - synfig <unfixed> (embed)
865    
866    harfbuzz
867            - qt4-x11 <unfixed> (embed)
868    
869    libzip
870            - php5 <unfixable> (modified-embed)
871            - odt2txt <unfixed> (embed; bug #523808)
872    
873    json.php (not packaged; should be replaced with php's built-in functions)
874            - moodle <unfixed>
875            - yui <unfixed>
876            - gallery2 <unfixed>
877            - dokuwiki <unfixed>
878            - typo3-src <unfixed>
879    
880    php-fpdf
881            - tcpdf <itp> (fork)
882            - moodle <unfixed>
883            - phpwiki <unfixed>
884            - egroupware <unfixed>
885            - ldap-account-manager <unfixed> (fork)
886    
887    tcpdf (itp: #495985)
888            - moodle <unfixed>
889            - phpmyadmin <unfixed>
890    
891    typo3
892            - moodle <unfixed>
893    
894    spreadsheet_writeexcel (PHP port of libspreadsheet-writeexcel-perl; itp: #487557)
895            - moodle <unfixed>
896            - gosa <unfixed>
897    
898    php-ole (itp: #487558)
899            - moodle <unfixed>
900    
901    pieforms (http://www.catalyst.net.nz)
902            - mahara <unfixed>
903    
904    savant2 (http://phpsavant.com)
905            - egroupware <unfixed>
906    
907    rssparser (http://nwow.org)
908            - egroupware <unfixed>
909            - phpgroupware <unfixed>
910    
911    lcms
912            - openjdk-6 <unfixed> (fork)
913    
914    libphp-phplayersmenu
915            - diogenes <unfixed>
916            - phpldapadmin <unfixed>
917    
918    libphp-pclzip
919            - docvert <unfixed>
920            - moodle <unfixed>
921            - egroupware <unfixed>
922    
923    libphp-simplepie
924            - dokuwiki <unfixed>
925    
926    libphp-jpgraph
927            - egroupware <unfixed>
928    
929    php-simpletest
930            - moodle <unfixed>
931    
932    libpng
933            - iceweasel <not-affected> (uses xulrunner)
934            - icedove 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1, 2.0.0.19-1 (embed)
935            - iceape 1.0.13~pre080614i-0etch1 (embed)
936            - xulrunner 1.9.0.13-1 (embed)
937            [lenny] - xulrunner 1.9.0.11-0lenny1
938            [etch] - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
939            - gamera 3.2.3-1 (embed)
940    
941    irssi
942            - silc-client <unfixed> (embed)
943            NOTE: Seems to be a pre-0.8.12 version that is used in irssi-plugin-silc
944    
945    extc
946            - mtasc <unfixed> (embed)
947            - haxe <unfixed> (embed)
948    
949    swflib
950            - mtasc <unfixed> (embed)
951            - haxe <unfixed> (embed)
952    
953    libitext-java
954            - bouncycastle 2.1.4-1 (embed)
955    
956    python-ply
957            - pyke <unfixed> (embed; bug #555363)
958            - pywbem <unfixed> (embed; bug #555364)
959            - sepolgen <unfixed> (embed; bug #555365)
960            - zope-textindexng3 <unknown> (embed)
961            - iceweasel <not-affected> (uses xulrunner)
962            - xulrunner <unknown> (embed)
963            - wireshark <not-affected> (python-ply modules are not installed into binary packages; see #554613)
964    
965    libdumbnet (libdnet upstream)
966            - nmap <unfixed> (fork)
967    
968    gcc-4.4
969            - gcc-mingw32 <unfixed> (embed)
970    
971    camlimages
972            - advi <unfixed> (static; bug #550441)
973    
974    memcached
975            - memcachedb <unfixed> (embed)
976    
977    yajl
978            - argyll <unfixed> (embed; bug #544223)
979            NOTE: reference, confirmed by build logs: http://lists.debian.org/debian-mentors/2009/08/msg00062.html
980    
981    nusoap
982            - gforge 4.8.2-1 (embed)
983    
984    libept
985            - adept <unfixed> (embed; bug #540649)
986    
987    libvorbis
988            - iceweasel <not-affected> (uses xulrunner)
989            - xulrunner <unfixed> (embed; bug #540959)
990            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
991            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
992            - iceape <unfixed> (embed)
993            [etch] - iceape <not-affected> (introduced in 2.0)
994            [lenny] - iceape <not-affected> (introduced in 2.0)
995    
996    cairo
997            - iceweasel <not-affected> (uses xulrunner)
998            - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
999    
1000    liboggz
1001            - iceweasel <not-affected> (uses xulrunner)
1002            - xulrunner <unfixed> (embed; bug #540959)
1003            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1004            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1005            - iceape <unfixed> (embed)
1006            [etch] - iceape <not-affected> (introduced in 2.0)
1007            [lenny] - iceape <not-affected> (introduced in 2.0)
1008    
1009    liboggplay
1010            - iceweasel <not-affected> (uses xulrunner)
1011            - xulrunner <unfixed> (embed; bug #540959)
1012            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1013            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1014            - iceape <unfixed> (embed)
1015            [etch] - iceape <not-affected> (introduced in 2.0)
1016            [lenny] - iceape <not-affected> (introduced in 2.0)
1017    
1018    php-net-dnsbl
1019            - serendipity <unfixed> (embed)
1020    
1021    php-onyx-rss
1022            - serendipity <unfixed> (embed)
1023    
1024    php-text-wiki
1025            - serendipity <unfixed> (embed)
1026    
1027    php-xml-rpc
1028            - serendipity <unfixed> (embed)
1029    
1030    polarssl (does not have a shared library)
1031            - pdkim <itp> (embed; bug #543150)
1032            - xyssl <unfixed> (old-version)
1033    
1034    pidgin
1035            - gaim <removed> (old-version)
1036            - qutecom <unfixed> (embed; bug #559785)
1037    
1038    icu
1039            - webkit 1.0.1-1 (embed; bug #547214)
1040            - texlive-bin <unfixed> (fork)
1041            NOTE: texlive upstream working with icu upstream to merge their changes
1042    
1043    cyrus-imapd-2.2
1044            - kolab-cyrus-imapd <unfixed> (fork)
1045            - dovecot 1:1.2.1-1 (embed) [/dovecot-sieve/src/libsieve/*]
1046    
1047    python-cxx-dev
1048            - freecad 0.9.2646.3-1 (embed; bug #547936)
1049    
1050    zipios++
1051            - freecad 0.9.2646.3-1 (embed; bug #547941)
1052            - enigma 0.92.3-3 (embed)
1053            NOTE: likely fixed earlier, marking etch's version as fixed
1054    
1055    linux-2.6
1056            - kvm <unfixed> (embed; bug #549973) [./kernel/*]
1057            - linux-kbuild-2.6 <unfixed> (embed; bug #550379) [./kbuild/*]
1058            - kernel-source-2.6.8 <removed> (old-version)
1059            - kernel-source-2.4.27 <removed> (old-version)
1060            - kernel-source-2.4.24 <removed> (old-version)
1061            - kernel-source-2.2.25 <removed> (old-version)
1062            - kernel-source-2.2.20 <removed> (old-version)
1063    
1064    libfdt (not yet packaged separately for debian; http://www.jdl.com/software/)
1065            - kvm <unfixed> (embed) [./libfdt/*]
1066    
1067    qweb (not packaged)
1068            - ajaxterm <unfixed>
1069    
1070    opensaml2
1071            - opensaml <removed> (old-version)
1072    
1073    shibboleth-sp2
1074            - shibboleth-sp <removed> (old-version)
1075    
1076    tuxonice-userui
1077            - suspend2-userui <removed> (old-version)
1078    
1079    expat
1080            - w3c-libwww <removed> (embed; bug #551941)
1081            [etch] - w3c-libwww <unfixed> (embed; bug #551941) [./modules/expat/*]
1082            - python-xml <unfixed> (embed; bug #551940) [./extensions/expat/*]
1083            - python2.5 <unfixable> (embed; bug #553403) [./Modules/expat/*]
1084            - python2.4 <unfixable> (embed; bug #553403)
1085            - python-4suite <unfixed> (embed; bug #516935)
1086            - wxwindows2.4 <removed> (embed)
1087            - wxwidgets2.6 2.6.3.2.2-4 (embed)
1088            - wxwidgets2.8 2.8.10.1-2 (embed)
1089            - celementtree 1.0.5-8 (embed)
1090            NOTE: Maybe that was fixed even earlier
1091            - audacity 1.3.2-1 (embed)
1092            - matanza <unfixed> (embed)
1093            - tdom <unfixed> (embed)
1094            - udunits 2.1.8-4 (embed)
1095            - apr-util 1.2 (embed)
1096            - ayttm <unfxed> (embed; bug #561006)
1097            - cableswig <unfixed> (embed)
1098            - cadaver <unfixed> (embed)
1099            - cmake 2.6.0-6 (embed)
1100            - coin3 <unfixed> (embed)
1101            - gdcm 2.0.14-2 (embed)
1102            - ghostscript <unfixed> (embed)
1103            - grmonitor <unfixed> (embed)
1104            - iceape <unfixed> (embed)
1105            - insighttoolkit 3.16.0-1 (embed)
1106            NOTE: insighttoolkit might've been fixed earlier
1107            - libparagui1.1 <unfixed> (embed)
1108            - paraview <unfixed> (embed)
1109            - poco <unfixed> (embed)
1110            - simgear <unfixed> (embed)
1111            - sitecopy 1:0.16.0-1
1112            - smart 1.0-1 (embed)
1113            - swish-e <unfixed> (embed)
1114            - tla <unfixed> (embed)
1115            - vtk 4.1.20030227-1 (embed)
1116            - wbxml2 <unfixed> (embed)
1117            - xmlrpc-c <unfixed> (embed)
1118            - iceweasel <unfixed> (embed)
1119            - kompozer <unfixed> (embed)
1120            - vxl 1.13.0-2 (embed)
1121            - xulrunner <unfixed> (embed)
1122            - apache2 2.2 (embed)
1123            - texlive-bin <not-affected> (Embedded code not compiled in)
1124            - vnc4 <unfixed> (embed)
1125            - xotcl <unfixed> (embed)
1126    
1127    xerces-c
1128            - xerces-c2 <unfixed> (old-version)
1129            - xerces27 <removed> (old-version)
1130    
1131    md5 (RSA's version; not the gnu version provided by coreutils)
1132            - w3c-libwww <removed> (embed; bug #551942)
1133            [etch] - w3c-libwww <unfixed> (embed; bug #551942) [./modules/md5/*]
1134    
1135    enet
1136            - sauerbraten <unfixed> (embed; #497194)
1137    
1138    eglibc
1139            - glibc <removed> (old-version)
1140    
1141    galib
1142            - gamera 3.2.3-1 (embed)
1143    
1144    configobj
1145            - bzr <unfixed> (embed; bug #555336)
1146            - elisa <unfixed> (embed; bug #555337)
1147            - gaupol <unfixed> (embed; bug #555338)
1148            - ipython <unfixed> (embed; bug #555339)
1149            - pida <unfixed> (embed; bug #555340)
1150            - psychopy <unfixed> (embed; bug #555341)
1151            - rest2web <unfixed> (embed; bug #555342)
1152            - auth2db <unknown> (embed)
1153            - dynagen <unknown> (embed)
1154            - iceweasel <unknown> (embed)
1155            - sabnzbdplus <unknown> (embed)
1156            - xulrunner <unknown> (embed)
1157            - nipy <not-affected> (part of an example [/examples/neurospin/neurospy/configobj.py], which is not installed into binary packages)
1158    
1159    python-clientform
1160            - bibus <unfixed> (embed; bug #555332)
1161            - zope2.10 <unfixed> (embed; bug #555333)
1162            - zope2.11 <unfixed> (embed; bug #555334)
1163            - python-mechanize <unknown> (embed)
1164            - twill <unknown> (embed)
1165    
1166    python-mechanize
1167            - zope2.10 <unfixed> (embed; bug #555337)
1168            - zope2.11 <unfixed> (embed; bug #555338)
1169            - twill <unknown> (embed; bug #555339)
1170    
1171    pexpect
1172            - duplicity 0.6.06-1 (embed; bug #555361)
1173            - hplip <unfixed> (embed; bug #555362)
1174            - smart <unfixed> (embed; bug #555363)
1175    
1176    pyparsing
1177            - bauble <unfixed> (embed; bug #555366)
1178            - boa-constructor 0.6.1-8 (embed; bug #555367)
1179            - calibre <unfixed> (embed; bug #555368)
1180            - matplotlib <unfixed> (embed; bug #531024)
1181            - zhpy <unfixed> (embed; bug #555370)
1182            - polybori <unknown> (embed)
1183            - python-whoosh <unknown> (embed)
1184            - twill <unknown> (embed)
1185            - zope-textindexng3 <unknown> (embed)
1186    
1187    python-pysqlite2
1188            - python2.4 <unfixed> (embed; bug #553403)
1189            - python2.5 <unfixed> (embed; bug #553403)
1190    
1191    celementtree
1192            - python2.5 <unfixed> (embed)
1193            - smart 1.0-1 (embed)
1194            [etch] - smart <unfixed> (embed)
1195    
1196    elementtree
1197            - python2.5 <unfixed> (embed)
1198            - bzr <unfixed> (embed; bug #555343)
1199            - gedit 2.28.2-1 (embed; bug #555344)
1200            - smart 1.0-1 (embed)
1201            [etch] - smart <unfixed> (embed)
1202            - solfege <unfixed> (embed; bug #555345)
1203            - w3af <unfixed> (embed; bug #555346)
1204            - python-qt4 <unknown> (embed)
1205            - sphinx <unknown> (embed)
1206            - python-nltk <itp> (embed)
1207    
1208    python2.5
1209            - python2.4 <unfixed> (old-version)
1210            - jython <unfixed> (embed)
1211            NOTE: embeds many stdlib modules
1212            - python-django <unfixed> (embed; bug #555419)
1213            NOTE: embeds stdlib modules: doctest, decimal
1214            - gamera 3.2.3-1 (embed)
1215            NOTE: embeds stdlib modules: ConfigParser, optparse, sets, textwrap
1216            - boa-constructor <unfixed> (embed; bug #555426)
1217            NOTE: embeds stdlib modules: ConfigParser, tarfile, zipfile, xmlrpclib
1218            - nicotine <unfixed> (embed; bug #555427)
1219            NOTE: embeds stdlib modules: ConfigParser
1220            - museek+ <unfixed> (embed; bug #555428)
1221            NOTE: embeds stdlib modules: ConfigParser
1222            - vegastrike-data <unfixed> (embed)
1223            NOTE: embeds many stdlib modules
1224            - codespeak-lib 1.1.1-1 (embed; bug #555420)
1225            NOTE: embeds stdlib modules: doctest, optparse, subprocess, textwrap
1226            - config-manager <unfixed> (embed; bug #555423)
1227            NOTE: embeds stdlib modules: optparse
1228            - jhbuild 2.28.0-1 (embed; bug #555421)
1229            NOTE: embeds stdlib modules: optparse, subprocess
1230            - smart <unfixed> (embed; bug #555432)
1231            NOTE: embeds stdlib modules: optparse
1232            - pyprotocols 1.0a.svn20070625-5 (embed; bug #555433)
1233            NOTE: embeds stdlib modules: doctest
1234            - ruledispatch 0.5a.svn20080510-4 (embed; bug #555434)
1235            NOTE: embeds stdlib modules: doctest
1236            - distribute <unfixed> (embed)
1237            NOTE: embeds stdlib modules: doctest
1238            - python-setuptools <unfixed> (embed; bug #555435)
1239            NOTE: embeds stdlib modules: doctest
1240            - zope.testing <unfixed> (embed; bug #555436)
1241            NOTE: embeds stdlib modules: doctest
1242            - translate-toolkit <unfixed> (embed; bug #555422)
1243            NOTE: embeds stdlib modules: textwrap, contextlib
1244            - libtpclient-py <unfixed> (embed; bug #555424)
1245            NOTE: embeds stdlib modules: subprocess
1246            - grass <unfixed> (embed; bug #555425)
1247            NOTE: embeds stdlib modules: subprocess
1248            - coherence <unfixed> (embed; bug #555429)
1249            NOTE: embeds stdlib modules: uuid
1250            - python-django-extensions 0.4.2pre+git200911182050-1 (embed; bug #555430)
1251            NOTE: embeds stdlib modules: uuid
1252            - setroubleshoot <unfixed> (embed; bug #555431)
1253            NOTE: embeds stdlib modules: uuid
1254            - linkchecker <unfixed> (embed; bug #555414)
1255            NOTE: embeds msgfmt.py script
1256            - imdbpy <unfixed> (embed)
1257            NOTE: embeds msgfmt.py script
1258            - kiwi <unfixed> (embed)
1259            NOTE: embeds msgfmt.py script
1260            - moin <unfixed> (embed)
1261            NOTE: embeds msgfmt.py script, stdlib modules: cgitb, difflib, tarfile
1262            - plone3 <unfixed> (embed)
1263            NOTE: embeds msgfmt.py script
1264            - roundup <unfixed> (embed)
1265            NOTE: embeds msgfmt.py script, stdlib modules: cgitb
1266            - rednotebook <unfixed> (embed; bug #555415)
1267            NOTE: embeds msgfmt.py script
1268            - turbogears <unfixed> (embed)
1269            NOTE: embeds msgfmt.py script
1270            - elisa <unfixed> (embed)
1271            NOTE: embeds msgfmt.py script, stdlib modules: uuid
1272            - calibre <unfixed> (embed)
1273            NOTE: embeds msgfmt.py script, stdlib modules: zipfile
1274            - mailman <unfixed> (embed; #555416)
1275            NOTE: embeds msgfmt.py script
1276            - python-docutils <unknown> (embed)
1277            NOTE: embeds stdlib modules: optparse, textwrap
1278            - python-imaging <unknown> (embed)
1279            NOTE: embeds stdlib modules: doctest
1280            - python-mechanize <unknown> (embed)
1281            NOTE: embeds stdlib modules: doctest
1282            - twill <unknown> (embed)
1283            NOTE: embeds stdlib modules: subprocess
1284            - zeroc-ice <unknown> (embed)
1285            NOTE: embeds stdlib modules: subprocess
1286            - wxwidgets2.8 <unknown> (embed)
1287            NOTE: embeds stdlib modules: subprocess
1288            - cycle <unknown> (embed)
1289            NOTE: embeds msgfmt.py script
1290            - deluge <unknown> (embed)
1291            NOTE: embeds msgfmt.py script
1292            - opendict <unknown> (embed)
1293            NOTE: embeds msgfmt.py script
1294            - openerp-client <unknown> (embed)
1295            NOTE: embeds msgfmt.py script
1296            - rapidsvn <unknown> (embed)
1297            NOTE: embeds msgfmt.py script
1298            - wammu <unknown> (embed)
1299            NOTE: embeds msgfmt.py script
1300            - gaphor <unknown> (embed)
1301            NOTE: embeds msgfmt.py script
1302            - pida <unknown> (embed)
1303            NOTE: embeds msgfmt.py script
1304            - python-formencode <unknown> (embed)
1305            NOTE: embeds msgfmt.py script
1306            - duplicity <unfixed> (embed)
1307            NOTE: embeds stdlib module: urlparse, tarfile
1308            - pygopherd <unfixed> (embed)
1309            NOTE: embeds stdlib module: zipfile
1310    
1311    argparse
1312            - twill <unfixed> (embed; bug #555347)
1313            - ipython <unfixed> (embed; bug #555348)
1314    
1315    coherence
1316            - elisa <unfixed> (embed; bug #555335)
1317    
1318    simpletal
1319            - plastex <unfixed> (embed; bug #555371)
1320    
1321    flickrpc (not packaged in Debian, http://burtonini.com/bzr/flickrpc/)
1322            - postr <unfixed> (embed)
1323            - elisa <unfixed> (embed)
1324    
1325    simplegeneric (not packaged in Debian, http://pypi.python.org/pypi/simplegeneric)
1326            - apertium-tolk <unfixed> (embed)
1327            - ipython <unfixed> (embed)
1328            - virtaal <unfixed> (embed)
1329    
1330    distribute
1331            - setuptools <removed> (old-version)
1332    
1333    rails
1334            - jruby1.2 <unfixed> (embed) [./bench/rails/*]
1335            - libgettext-ruby <unfixed> (embed) [./samples/rails/*]
1336            - libopenid-ruby <unfixed> (embed) [./examples/rails_openid/*]
1337            - thin <unfixed> (embed) [./spec/rails_app/*]
1338            NOTE: this is a subdirectory of examples, which in general is a non-issue, but may
1339            NOTE: be dangerous if developers are naively basing their code off of the examples
1340            NOTE: prototype.js is among the example files
1341    
1342    lucene2 (prototype.js is among the embeds in the following)
1343            - lucene <unfixed> (old-version)
1344            - pylucene <unfixed> (embed)
1345            - libpdfbox-java <unfixed> (embed)
1346            - libfontbox-java <unfixed> (embed)
1347            - libjempbox-java <unfixed> (embed)
1348            - solr <unfixed> (embed)
1349    
1350    unicode-data
1351            - syslinux <unfixed> (embed)
1352            - camomile <unfixed> (embed)
1353            - fribidi <unfixed> (embed)
1354            - m17n-db <unfixed> (embed)
1355            - sbcl <unfixed> (embed)
1356            - heimdal <unfixed> (embed)
1357            - icu <unfixed> (embed)
1358            - icu4j <unfixed> (embed)
1359            - krb5 <unfixed> (embed)
1360            - moodle <unfixed> (embed)
1361            - openldap <unfixed> (embed)
1362            - pike7.6 <unfixed> (embed)
1363            - samba <unfixed> (embed)
1364            - samba4 <unfixed> (embed)
1365            - cmucl <unfixed> (embed)
1366            - typo3-src <unfixed> (embed)
1367            - mauve <unfixed> (embed)
1368            - texlive-bin <unfixed> (embed)
1369            - ypsilon <unfixed> (embed)
1370            - jeuclid <unfixed> (embed)
1371            - charmap.app <unfixed> (embed)
1372            - clisp <unfixed> (embed)
1373            - gnulib <unfixed> (embed)
1374            - opensrs-client <unfixed> (embed)
1375            - saxonb <unfixed> (embed)
1376            - rails <unfixed> (embed)
1377    
1378    feedparser
1379            - rawdog <unfixed> (embed; bug #383422)
1380            - miro <unfixed> (embed; bug #555351)
1381            - calibre <unfixed> (embed; bug #555352)
1382            - freevo <unfixed> (embed; bug #555353)
1383            - pida <unfixed> (embed; bug #555354)
1384            - planet-venus <unfixed> (embed; bug #555355)
1385            - plone3 <unfixed> (embed; bug #555356)
1386            - exaile 0.2.14+debian-1 (embed)
1387            - screenlets 0.1.2-3 (embed)
1388            NOTE: included twice
1389    
1390    agg:
1391            - matplotlib <unfixed> (embed: bug #377271)
1392            - contextfree <unfixed> (embed)
1393            NOTE: since 2.2-1 it links statically to system libagg, but still uses the embedded copy
1394            - exactimage <unfixed> (embed)
1395            - python-enable <unfixed> (embed)
1396            - mapnik 0.5.1-3 (embed)
1397            NOTE: links statically to agg, but shared library is not available (bug #377271)
1398    
1399    vtk
1400            - paraview <unfixable> (embed; bug #495426)
1401    
1402    txt2tags
1403            - rednotebook <unfixed> (embed)
1404    
1405    htmltextview (not packaged in Debian, http://www.gnome.org/~gjc/htmltextview.py)
1406            - gajim <unfixed> (embed)
1407            - emesene <unfixed> (embed)
1408            - convirt <unfixed> (embed)
1409            - pida <unfixed> (embed)
1410            - rednotebook <unfixed> (embed)
1411    
1412    horde3 (prototype.js is among the embeds in the following)
1413            - mnemo2 <unfixed> (embed)
1414            - nag2 <unfixed> (embed)
1415    
1416    cimg
1417            - gmic <itp> (embed)
1418    
1419    mootools
1420            - gmic <itp> (embed)
1421    
1422    openldap
1423            - openldap2.3 <removed> (old-version)
1424    
1425    grub2
1426            - grub <unfixed> (old-version)
1427    
1428    gnupginterface
1429            - duplicity <unfixed> (embed)
1430    
1431    python-dateutil
1432            - awn-extras-applets <unfixed> (embed)
1433            - matplotlib <unknown> (embed)
1434    
1435    cups
1436            - cupsys <removed> (old-version)
1437    
1438    yui
1439            - bcfg2 <not-affected> (present in source but not included in any binary files)
1440            - serendipity <unfixed> (embed; bug #557746)
1441            - moodle 1.8.2.dfsg-5 (embed)
1442            - jifty 0.91117-1 (embed; bug #557748)
1443            - webgui 7.7.26-1 (embed)
1444            - loggerhead 1.17-1 (embed)
1445    
1446    quake3 (vanilla source not packaged in debian)
1447            - openarena <unfixable> (fork)
1448    
1449    quake2 (vanilla source not packaged in debian)
1450            - alien-arena <unfixable> (fork)
1451            - warsow <unfixable> (fork)
1452    
1453    libtheora
1454            - iceweasel <not-affected> (uses xulrunner)
1455            - xulrunner <unfixed> (embed; bug #540959)
1456            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1457            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1458            - iceape <unfixed> (embed; bug #559276)
1459            [etch] - iceape <not-affected> (introduced in iceape 2.0)
1460            [lenny] - iceape <not-affected> (introduced in iceape 2.0)
1461    
1462    dtoa
1463            - bfilter <unfixed> (embed)
1464            - cacao <unfixed> (embed)
1465            - cdrdao <unfixed> (embed)
1466            - classpath <unfixed> (embed)
1467            - freej <unfixed> (embed)
1468            - iceape <unfixed> (embed)
1469            - iceweasel <unfixed> (embed)
1470            - jscoverage <unfixed> (embed)
1471            - kde4libs <unfixed> (embed)
1472            - kdelibs <unfixed> (embed)
1473            - kompozer <unfixed> (embed)
1474            - libv8 <unfixed> (embed)
1475            - mono <unfixed> (embed)
1476            - newlib <unfixed> (embed)
1477            - nspr <unfixed> (embed)
1478            - php5 <unfixed> (embed)
1479            - polyml <unfixed> (embed)
1480            - qt4-x11 <unfixed> (embed)
1481            - rhino <unfixed> (embed)
1482            NOTE: code translated to Java
1483            - ruby1.8 <unfixed> (embed)
1484            - ruby1.9 <unfixed> (embed)
1485            - ruby1.9.1 <unfixed> (embed)
1486            - sdd <unfixed> (embed)
1487            - sfind <unfixed> (embed)
1488            - star <unfixed> (embed)
1489            - tinymux <unfixed> (embed)
1490            - virtualbox-ose <unfixed> (embed)
1491            - webkit <unfixed> (embed)
1492            - xulrunner <unfixed> (embed)
1493    
1494    ipc (not packaged in Debian; see http://mozdev.org/pipermail/enigmail/2009-November/011678.html)
1495            - firegpg <unfixed> (embed)
1496            - enigmail <unfixed> (embed)
1497    
1498    ptmalloc (not packaged in Debian)
1499            - crystalspace <unfixed> (embed)
1500            - qt4-x11 <unfixed> (embed)
1501    
1502    svgalib
1503            - usplash <unfixed> (embed)
1504    
1505    bogl
1506            - usplash <unfixed> (embed)
1507    
1508    taglist
1509            - usplash <unfixed> (embed)
1510    
1511    portaudio
1512            - audacity <unfixed> (embed; bug #323711)
1513    
1514    nyquist
1515            - audacity <unfixed> (embed)
1516            NOTE: embeds a forked nyquist with support for a shared library
1517    
1518    vamp-plugin-sdk
1519            - audacity <unfixed> (embed)
1520    
1521    wordpress
1522            - libwordpress-xmlrpc-perl <removed> (embed) [./xmlrpc.php]
1523    
1524    php5
1525            - php4 <removed> (old-version)
1526    
1527    classpath
1528            - libgnucrypto-java <unfixed> (embed; bug #559788)
1529    
1530    libtool
1531            - apr <unfixed> (static; bug #489625)
1532            NOTE: ships copy of libtool in libapr1-dev; was 'embed' before 1.3.2-3
1533            - arts <unfixed> (embed)
1534            - bochs <unfixed> (embed; bug #560884)
1535            - camserv <unfixed> (embed)
1536            - collectd <unfixed> (embed)
1537            - courier-authlib 0.58-4 (embed)
1538            NOTE: The etch version of courier-authlib was the earliest version checked, might be fixed earlier
1539            - cvsnt <unfixed> (embed)
1540            - dico <not-affected> (Uses the system copy of ltdl)
1541            - freeradius 0.1+20010527-1 (embed)
1542            NOTE: Earliest reference I could find from the changelog is from 27 May 2001
1543            - ggobi 2.1.9~20091212-1 (embed)
1544            - glame <unfixed> (embed)
1545            - gnash <unfixed> (embed)
1546            - gnu-smalltalk <unfixed> (embed)
1547            - google-gadgets <unfixed> (embed)
1548            - graphicsmagick 1.3.5-6 (embed)
1549            - graphviz 2.8-3 (embed)
1550            NOTE: The etch version of graphviz was the earliest version checked, might be fixed earlier
1551            - guile-1.6 1.6.8-7 (embed)
1552            - hamlib <unfixed> (embed)
1553            - hercules <unfixed> (embed)
1554            - jags 1.0.4-3 (embed; bug #560864)
1555            - kdelibs <unfixed> (embed)
1556            - libannodex <removed> (embed)
1557            - libextractor <unfixed> (embed)
1558            - libmcrypt <not-affected> (libtool source present but not included in any of the binary packages)
1559            - libtunepimp <unfixed> (embed)
1560            - mp4h <unfixed> (embed)
1561            - naim <unfixed> (embed)
1562            - parser-mysql <unfixed> (embed)
1563            - pinball <unfixed> (embed)
1564            - redland <unfixed> (embed)
1565            - siproxd <unfixed> (embed)
1566            - ski <unfixed> (embed)
1567            - synfig <unfixed> (embed)
1568            - unixodbc 2.2.4-5 (embed)
1569            - xmlsec1 <not-affected> (Doesn't enable dynamic loading of crypto modules)
1570            - clamav 0.95+dfsg-1 (embed)
1571            - imagemagick 6:6.2.3.1-1 (embed)
1572            - hypre 2.4.0b-5 (embed)
1573            - lam <unfixed> (embed)
1574            - openmpi <unfixable> (embed; bug #559386)
1575            - parser <unfixed> (embed)
1576            - pdsh 2.18-5 (embed; bug #560892)
1577            - sbnc 1.2-8 (embed)
1578            - sdcc <unfixed> (embed)
1579            - wml <unfixed> (embed)
1580            - proftpd-dfsg <unfixed> (embed; bug #561748)
1581            - babel 1.4.0.dfsg-5 (embed)
1582            - libprelude 0.9.14-2 (embed)
1583            - heartbeat 2.1.4-7 (embed)
1584            NOTE: From Squeeze onwards the system copy of ltdl is used, use the current version from Squeeze,
1585            NOTE: might've been fixed earlier
1586            - gcc-* <unknown> (embed)
1587    
1588    ocamlgsl
1589            - orpie 1.5.1-7.1 (embed; bug #550058)
1590    
1591    xdotool
1592            - keynav <unfixed> (embed; bug #560103)
1593    
1594    bulletphysics (not packaged; http://www.bulletphysics.org/)
1595            - supertuxkart <unfixed> (embed)
1596            - blender <unfixed> (embed)
1597    
1598  libghttp:  ghostscript
1599  hotway          - gs-gpl <removed> (old-version)
1600    
1601  etl-dev (will be renamed to libetl-dev soon):  icedove
1602  synfig          - thunderbird <removed> (old-version)
1603    
 libphp-adodb:  
 moodle  
1604    sizzlejs (not packaged in Debian, http://sizzlejs.com/)
1605            - libjs-jquery <unfixed> (embed)

Legend:
Removed from v.3729  
changed lines
  Added in v.13647

  ViewVC Help
Powered by ViewVC 1.1.5