/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 5321 by stef-guest, Mon Jan 22 17:54:13 2007 UTC revision 13608 by gilbert-guest, Sun Dec 20 05:08:20 2009 UTC
# Line 1  Line 1 
1  This file collects cases, where a source package embeds code from  Embedded code copies
2  other projects, without linking dynamically:  ====================
3    
4  xpdf code: (some use xpdf 2, some xpdf 3)  This file collects source packages that embed code from other projects.
5  gpdf (will be replaced by evince in Gnome 2.12)  This is considered bad for fixing security flaws because the fix needs
6  pdftohtml (current poppler source package has a ported version, pinged maintainer)  to be applied in multiple source packages.
7  kdegraphics/kpdf (upstream is working on using poppler, probably not in time for Etch)  
8  tetex-bin (links to poppler since 3.0-12)  Format:
9  cupsys (only older releases, recent ones use xpdf-utils, it's still present in the src, though)  <srcpkg> (<optional comment about srcpkg>)
10  poppler          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11  koffice/kword (upstream is working on using poppler, probably not in time for Etch)          NOTE: optional comments about the linkage of the embedding srcpkg
12  libextractor (uses internal pdf decoder since 0.5.12-1)  
13  pdfkit.framework (links to poppler since 0.8-4)  status: version number fixing the embedded copy, <unfixed>, <removed>,
14            <itp>, <not-affected>, <unknown> if the version number can not
15  zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)          be determined, or <unfixable> for unavoidable cases (e.g., forks
16  dpkg          that add real value)
17  rsync (somehow derived code base)  sort: static (linking statically against a lib)
18  mozilla(?)        embed (embeds a copy of the library into another source package)
19  Linux kernels        modified-embed (embeds a code copy that differs from upstream code)
20  pvpgn (links dynamically since 1.7.8-2)        fork (a full-blown fork of another source package)
21  mrtg (links dynamically since 2.12.2-1)        old-version (an older version of essentially the same code)
22  rpm  
23    The srcpkg might be some string to identify the code if there is no
24  libbz2:  specific source package.
25  dpkg (statically linked)  
26    Everything up to the next line is ignored.
27  libgadu/ekg:  ---BEGIN
28  centericq  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29  gaim          NOTE: Fixed packages link to poppler library unless otherwise noted
30  kopete (ships the code, but links dynamically in the Debian package)          - pdftohtml <unknown>
31  kadu (not packaged in Debian)          [sarge] - pdftohtml <unfixed>
32  GNU gadu (not yet packaged in Debian)          [etch] - pdftohtml <unfixed>
33            NOTE: has been replaced by poppler-utils
34  xmlrpc: (which package is the "origin" of this code?)          - kdegraphics 4:4.2.2-1 (embed; bug #436164)
35  drupal          - texlive-base 3.0-12 (embed)
36  phpgroupware          - texlive-bin 2007-1 (embed)
37  egroupware          NOTE: links to poppler
38  phpwiki          - koffice <unfixed> (embed; bug #436163)
39  php4 (php-pear, IIRC this was reorganized some weeks ago?)          - libextractor 0.5.12-1 (embed)
40  tikiwiki          NOTE: libextractor is using its own pdf decoder now
41            - ipe <unfixed> (embed)
42  shtool: (affects build-time only)          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
43  mysql-ocaml          - ruby-gnome2 <unknown> (embed)
44  php4          NOTE: copy only present in source but links to poppler
45            - pdfedit <unfixed> (embed; bug #510794)
46  mozilla:          - swftools <unfixed> (embed; bug #551293)
47  mozilla-firefox          - poppler <unfixable> (fork)
48  mozilla-thunderbird  
49  firefox (to be removed)  ppmd
50  thunderbird (to be removed)          - libcomplearn-mod-ppmd <unfixed> (fork)
51  iceweasel          NOTE: discussion in #458152
52  iceape  
53  icedove  libevent
54  xulrunner          - transmission 1.71-1 (embed; bug #529372)
55  nvu (no longer in Debian)  
56    lrmi
57  xli:          - read-edid 2.0.0-1 (embed; bug #495131)
58  xloadimage          - s3switch <unfixed> (embed)
59            - xresprobe <unfixed> (embed)
60  lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)          - zhcon <unfixed> (embed)
61  openmotif  
62  xfree86/xorg (in libxpm)  peercast
63            - gnome-peercast <removed> (embed)
64  kerberized apps with BSD origin:          [etch] - gnome-peercast <unfixed> (embed)
65  krb4  
66  krb5  silc-toolkit
67  heimdal          - silc-client 1.1~beta6-1 (embed)
68    
69  grip: (which pkg is the origin?)  icclib
70  libcdaudio          - ghostscript <unfixed> (embed)
71  grip          - argyll <unfixed> (embed)
72  gnome-vfs (vfs2 as well?)  
73    dietlibc
74  fudforum:          - ccontrol 0.9.1+20071204-1 (static)
75  phpgroupware-fudforum  
76  egroupware-fudforum (removed from egroupware after sarge)  libmikmod
77            - sdl-mixer1.2 <unfixed> (embed)
78  cvs:          TODO: report bug
79  gcvs (at least an additional script is included, check if there's more)  
80    libiax
81  pcre:          - iaxmodem <unfixable> (embed; bug #548885)
82  all pythons  
83  php4 (src included, but Debian package links dynamically)  spandsp
84  analog (src included, but Debian package links dynamically)          - iaxmodem <unfixable> (embed; bug #548885)
85  libgoffice-1  
86  tf5 (since 5.0beta7 the Debian package links dynamically)  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
87            - dpkg <unfixed> (static)
88  tiff:          NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
89  wxpythongtk (check, which debian pkg this is in)          - rsync <unfixed> (embed)
90  older kdegraphics/kpdf releases < 3.3 embedded a copy          NOTE: somehow derived code base
91            - mono <unfixed> (embed)
92  uudeview:          TODO: check mozilla
93  libconvert-uulib-perl          - Linux kernels <unfixed> (embed)
94            - pvpgn 1.7.8-2 (embed)
95  sqlite: (not affected by security vulnerabilities so far)          - mrtg 2.12.2-1 (embed)
96  amarok          - rpm <unknown> (embed)
97            NOTE: pinged anibal since when rpm was fixed
98  util-linux/mount:          - tuxcmd-modules <unfixed> (embed)
99  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb          - zsync <unfixed>
100            - tra <unfixed>
101  webmin:          - sash <unfixed>
102  usermin (only in sarge)          - nsis <unfixed>
103            - mseide-msegui <unfixed>
104  sylpheed:          NOTE: mseide
105  sylpheed-claws          - mirrordir <unfixed>
106            - poco <unfixed>
107  phpsysinfo:          - klibc <unfixed>
108  egroupware          - ghostscript <unfixed>
109  phpgroupware          - freeimage <unfixed>
110            - clamav <unfixed> (fork)
111  phpldapadmin:          NOTE: from the changelog: "libclamav6 does indeed duplicate parts of the zlib code, but there is not way around that"
112  egroupware (removed from egroupware after sarge)          - tuxonice-userui <unfixed>
113            - plt-scheme <unfixed>
114  chmlib:          - perl <unfixed>
115  kchmviewer (not packaged in Debian)          - paraview <unfixed>
116            - gcvs <unfixed>
117            - dump <unfixed>
118            - aide <unfixed> (static)
119            - dar <unfixed> (static)
120            - avfs <unfixed>
121            - fpc <unfixed>
122            - winff <unfixed>
123            NOTE: inherited from fpc, see #472304
124            - lazarus <unfixed>
125            NOTE: inherited from fpc, see #472304
126            - erlang <unfixed> (embed)
127            - gamera 3.2.3-1 (embed)
128            - python2.4 <unfixed> (embed; bug #553403)
129            - python2.5 <unfixed> (embed; bug #553403)
130    
131    dulwich
132            - hg-git 0.1.0-1 (embed; bug #541996)
133    
134    libvigraimpex
135            - hugin <unfixed> (embed; bug #542259)
136            - enblend-enfuse <unfixed> (embed; bug #542258)
137            - gamera 3.2.3-1 (embed)
138    
139    libbz2
140            - dpkg <unfixed> (static)
141    
142    libgadu
143            - centerim <unfixed> (embed; bug #559783)
144            - pidgin <not-affected> (links dynamically since initial release; fixed in gaim)
145            - gaim 1:2.0.0+beta3-3 (embed; bug #360280)
146            - kdenetwork 4:3.3.2-5 (embed)
147            NOTE: from kdenetwork: kopete
148            - ekg 1:1.8~rc0-1 (embed)
149            - kadu 0.6.0.2-3 (embed; bug #504430)
150            - gadu <itp> (embed)
151    
152    xmlrpc (which package is the "origin" of this code?)
153            - drupal <unfixed> (embed)
154            - phpgroupware <unfixed> (embed)
155            - egroupware <unfixed> (embed)
156            - phpwiki <unfixed> (embed)
157            - php4 <unfixed> (embed)
158            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
159    
160    shtool (affects build-time only)
161            - mysql-ocaml <unfixed> (embed)
162            - php4 <unfixed> (embed)
163    
164  libavcodec/libavformat:  xulrunner
165  ffmpeg          - iceape <unfixed> (embed; bug #561749)
166  xine-lib          - iceweasel 2.0.0.19 (embed)
167  xvidcap          - icedove <unfixed> (embed; bug #561750)
168  kino (links statically, does not include code)          - kompozer <unfixed> (embed; bug #532168)
169  vlc (links statically, does not include code)          - galeon 2.0.2-4 (embed)
170  smilutils (links statically, does not include code)          - epiphany-browser 2.14.3-8 (embed)
171  motion (links statically, does not include code)          - conkeror 0.9~git080629-2 (embed)
172  gst-ffmpeg          - kazehakase 0.4.2-1 (embed)
173  gstreamer0.10-ffmpeg  
174  xmovie  xli
175            - xloadimage <unfixed> (embed)
176  mad MPEG decoding lib:  
177  mad  lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
178  xine-lib          - openmotif <unfixed> (embed)
179            - libxpm <unfixed> (embed)
180    
181    kerberized apps with BSD origin
182            - krb4 <removed> (embed)
183            - krb5 <unfixed> (embed)
184            - heimdal <unfixed> (embed)
185    
186    grip (which pkg is the origin?)
187            - libcdaudio <unfixed>
188            - grip <unfixed>
189            - gnome-vfs <unfixed>
190            TODO: check vfs2 as well
191    
192    fudforum
193            [etch] - phpgroupware <unfixed> (embed)
194            NOTE: phpgroupware-fudforum
195            [sarge] - egroupware-fudforum <removed> (embed)
196    
197    libbsd
198            - rdate 1:1.2-3 (embed)
199            - atheme-services <unfixed>
200            - libbsd-arc4random-perl <unfixed>
201            - isakmpd <unfixed>
202            - bsdgames <unfixed> (embed)
203            - bsd-mailx <unfixed> (embed)
204            - netcat-openbsd <unfixed> (embed; bug #550611)
205            - openssh <unfixed> (embed)
206            - unworkable <unfixed> (embed)
207    
208    cvs
209            - gcvs <unfixed> (embed)
210            NOTE: see cvsunix/src in tarball
211    
212    pcre3
213            - php4 <unknown> (embed)
214            - analog 2:5.23-0woody1 (embed)
215            - goffice <unfixed> (embed)
216            NOTE: libgoffice-*
217            - vfu 4.06-4.1 (embed; bug #450754)
218            - tf5 5.0beta7-1 (embed)
219            - monotone 0.43-1 (embed)
220            NOTE: this only affects versions >= 0.37
221            - glib2.0 2.15.2-1 (embed)
222            - apache2 2.0.53-4 (embed)
223            - exim4 4.10-0.srh20.12 (embed)
224            - yacas <unfixed> (embed)
225            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
226            - gtamsanalyzer.app 0.42-5 (embed)
227            - tin 980117-1 (embed)
228            - kazehakase 0.5.2-1
229            - webkit 1.0.1-1 (embed)
230            - qt4-x11 <unfixed> (embed)
231            NOTE: embedded via webkit copy
232            - erlang <unfixed> (embed)
233    
234    tiff
235            - wxwindows2.4 2.2.1 (embed)
236            - gamera 3.2.3-1 (embed)
237    
238    uudeview
239            - libconvert-uulib-perl <unfixed> (embed)
240            - pan <unfixed> (embed)
241    
242    sqlite (not affected by security vulnerabilities so far)
243            - amarok <unfixed> (embed)
244            - monotone 0.43-1 (embed)
245            - iceweasel <unfixed> (embed)
246            - heimdal <unfixed> (embed; bug #559616)
247    
248    util-linux/mount
249            - loop-aes-utils <unfixed> (embed)
250            NOTE: contains code from util-linux' mount in the mount-aes-udeb
251    
252    sylpheed
253            - sylpheed-claws <unfixed> (fork)
254    
255    phpsysinfo
256            - egroupware <unfixed> (embed)
257            - phpgroupware <unfixed> (embed)
258    
259    phpldapadmin
260            [sarge] - egroupware <unfixed> (embed)
261            NOTE: removed from egroupware after sarge
262    
263    chmlib
264            - kchmviewer <unknown> (embed)
265    
266    ffmpeg (libavcodec/libavformat)
267            - mplayer 1.0~rc2-14 (embed; bug #395252)
268            - kino 1.0.0-1
269            - vlc <not-affected> (Links dynamically since initial release)
270            - smilutils 0.3.0-10
271            NOTE: smilutils likely fixed earlier, marking Etch's version as fixed
272            - motion 3.1.19-1
273            - gstreamer0.10-ffmpeg 0.10.3-2
274            - xmovie <removed> (static)
275            TODO: gimp-gap (potentially using ffmpeg code as well)
276            - avifile 1:0.7.48~20090503.ds-1 (embed; bug #538750)
277            - audacity 1.3.7-2 (embed; bug #512278)
278    
279    faad2
280            - mplayer 1.0~rc2-20 (embed)
281            - avifile <unfixed> (embed; bug #538750)
282            - ffmpeg-debian <removed> (old-version)
283    
284    libmad (MPEG decoding lib)
285            - xine-lib <unfixed> (embed)
286            - avifile 1:0.7.48~20090503.ds-1 (embed) [./plugins/libmad/*]
287            TODO: check ocaml-mad, madplay, pymad, xmms-mad, xmms2
288    
 libdts:  
289  libdts  libdts
290  xine-lib          - xine-lib <unfixed> (embed)
291    
 flac:  
292  flac  flac
293  xine-lib          - xine-lib <unfixed> (embed)
   
 liba52:  
 a52dec  
 xine-lib  
294    
295  libmpeg2:  liba52
296  mpeg2dec          - a52dec <unfixed> (embed)
297  xine-lib          - xine-lib <unfixed> (embed)
298    
299    libmpeg2
300            - mpeg2dec <unfixed> (embed)
301            - xine-lib <unfixed> (embed)
302    
303    libntlm
304            - wget <unfixed> (fork; bug #550436)
305            - curl <unfixed> (fork; bug #550437)
306            - cntlm <unfixed> (fork; bug #550438)
307    
308    uw-imap
309            - pine <unfixed> (embed)
310            - alpine <unfixed> (embed)
311    
312    imagemagick
313            - graphicsmagick <unfixed> (fork)
314    
315    python-urlgrabber
316            - mercurial <unfixed> (embed; bug #531062)
317            - w3af <unfixed> (embed; bug #555372)
318            [experimental] - harvestman <unfixed> (embed; bug #555373)
319    
320    beautifulsoup
321            - python-mechanize <unfixed> (embed; bug #555349)
322            - zope2.11 <unfixed> (embed; bug #555350)
323            - twill <unknown> (embed)
324    
325    halibut
326            - nsis <unfixed> (fork)
327    
328    libghttp
329            - hotway <unfixed> (embed)
330    
331    libsndfile
332            - ardour 1:2.7.1-1 (embed)
333    
334    glibmm2.4
335            - ardour 1:2.7.1-1 (embed)
336    
337    libgnomecanvasmm2.6
338            - ardour 1:2.7.1-1 (embed)
339    
340    libsigc++-2.0
341            - ardour 1:2.7.1-1 (embed)
342    
343    soundtouch
344            - ardour 1:2.7.1-1 (embed)
345    
346    libmms
347            - xine-lib <unfixed> (embed)
348            - mimms <unfixed> (embed)
349    
350    fckeditor
351            - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
352            - moin 1.8.2-2 (embed; bug #452599)
353            - karrigell <removed> (embed; bug #452598)
354            - gforge 4.6.99+svn6225-1 (embed)
355            - request-tracker3.8 <unfixed> (embed)
356    
357    ipatlas (not packaged in Debian)
358            - moodle <unfixed> (embed; bug #507185)
359    
360    libphp-phpmailer
361            - moodle <unfixed> (embed; bug #507185)
362            - mahara <unfixed> (embed)
363            - symfony <unfixed> (embed)
364            [etch] - phpgroupware <unfixed> (embed)
365            NOTE: phpgroupware-felamimail is only in etch
366            - egroupware <unfixed> (embed; bug #504283)
367            - glpi <unfixed>
368    
369    htmlArea (not packaged in Debian)
370            - moodle <unfixed> (embed)
371    
372    giflib
373            - wine <unfixed> (embed; bug #466181)
374    
375    bennu (not packaged in Debian, http://bennu.sourceforge.net)
376            - moodle <unfixed> (embed)
377    
378    smarty
379            - moodle 1.8.2-2 (embed; bug #471158)
380            - gallery2 2.2.5-2 (embed; bug #471160)
381            - mahara 0.9.2-2 (embed; bug #471201)
382            - gosa 2.4beta1-1 (embed; bug #471200)
383    
384  curl:  TinyMCE
385  wget (code for NTLM authentication)          - wordpress 2.5.1-3 (embed; bug #478257)
386            - moodle <unfixed> (embed; bug #507185)
387  TODO evaluate:          - knowledgeroot <unfixed> (embed)
388  gimp-gap (potentially using ffmpeg code as well)          - joomla <itp> (bug #326398)
389    
390    scintilla (upstream provides static lib, rejected shared lib http://sf.net/support/tracker.php?aid=2488121)
391            - scite <unfixed> (embed)
392            - qscintilla <unfixed> (embed)
393            - qscintilla2 <unfixed> (embed)
394            - geany <unfixed> (fork)
395            - anjuta <unfixed> (embed)
396    
397    libphp-adodb
398            - moodle <unfixed> (embed; bug #507185)
399            NOTE: also AdoDB-XML Schema
400            - gallery2 <unfixed> (embed)
401            - phppgadmin <unfixed> (embed)
402            - egroupware <unfixed> (embed)
403            - phpwiki <unfixed> (embed)
404            - torrentflux 2.0beta1-2 (embed)
405            - ipplan <unfixed> (embed)
406            - typo3-src <unfixed> (embed)
407            - cacti <unknown> (embed)
408            [sarge] - cacti <unfixed> (embed)
409            NOTE: dependency exists, but internal version is used
410            - gforge 4.7~rc2-6 (embed)
411            - mahara <unfixed> (embed)
412    
413    gzip
414            - linux-kernel <unfixed> (embed)
415            NOTE: lib/inflate.c
416            - klibc <unfixed> (embed)
417            NOTE: based on linux-kernel gzip code
418            - busybox <unfixed> (embed)
419    
420    neon
421            - cadaver 0.22.3+debian-1 (embed; bug #188381)
422            - gnome-vfs2 <unfixed> (embed; bug #395874)
423            [etch] - litmus <unfixed> (embed; #395875)
424            - litmus <removed> (embed; #395875)
425            [sarge] - screem <unfixed> (embed)
426            - sitecopy 1:0.16.0-1 (embed; bug #395876)
427            [etch] - tla <unfixed> (embed; bug #395877)
428            [sarge] - tla <unfixed> (embed; bug #395877)
429    
430    libmodplug
431            - gst-plugins-bad0.10 <unfixed> (embed)
432    
433    libvncserver
434            - vino <unfixed> (embed)
435    
436    putty
437            - filezilla <unfixed> (embed)
438    
439    tinyxml (not packaged in Debian; itp bug #531968)
440            - filezilla <unfixed>
441            - crystalspace <unfixed> (embed)
442            - libwfut <unfixed> (embed)
443            - rarian <unfixed> (embed)
444            - bulletml <unfixed> (embed)
445            - pokerth <unfixed> (embed)
446            - qutecom <unfixed> (embed)
447            - sofa-framework <unfixed> (embed)
448            - yate <unfixed> (embed)
449            - antigrav <unfixed> (embed)
450            - balder2d <unfixed> (embed)
451            - cal3d <unfixed> (embed)
452            - criticalmass <unfixed> (embed)
453            - ember <unfixed> (embed)
454            - epiphany <unfixed> (embed)
455            - gambit <unfixed> (embed)
456            - noiz2sa <unfixed> (embed)
457            - ogre <unfixed> (embed)
458            - opencity <unfixed> (embed)
459            - openmovieeditor <unfixed> (embed)
460            - pouetchess <unfixed> (embed)
461            - tecnoballz <unfixed> (embed)
462            - trigger-rally <unfixed> (embed)
463            - xmoto <unfixed> (embed)
464            - mapnik <unknown> (embed)
465            NOTE: uses a different XML parser by default
466            - rrootage 0.23a-6 <embed>
467            NOTE: links to libbulltetml
468            - boson <unknown> (embed)
469            NOTE: the embedded code is unused
470    
471    gv
472            - evince <unfixed> (embed)
473            NOTE: ps/ tree from gv 3.5.8
474            NOTE: evince-gtk is affected (a component of evince source package)
475    
476    libXbae
477            - paw <removed> (embed)
478            [etch] - paw <unfixed> (embed)
479    
480    libgtkhtml
481            - claws-mail-extra-plugins <unfixed> (fork)
482    
483    libXaw
484            - paw <removed> (embed)
485            [etch] - paw <unfixed> (embed)
486            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
487    
488    libgd2
489            - graphviz <unfixed> (embed)
490            NOTE: lib/gd seems to be 2.0.33
491            - wml <unfixed> (embed)
492            - libwmf <unfixed> (embed)
493            NOTE: derived from gd 1.6.3
494    
495    rar
496            - unrar-nonfree <unfixed> (embed)
497    
498    unrar-free (maybe this code is derived from the original rar, too?)
499            - clamav <unfixed> (embed)
500            NOTE: seems to be disabled in default config
501    
502    mplayer (DirectMedia Object loader)
503            - xine-lib <unfixed> (embed)
504            NOTE: src/libw32dll/
505            - vlc <unfixed> (embed)
506            NOTE: modules/codec/dmo/
507            - mplayer 1.0~rc2-20 (embed)
508    
509    libwpd (WordPerfect converter)
510            - openoffice.org <unfixed> (embed)
511    
512    fsplib (http://sourceforge.net/projects/fsp/)
513            - gftp <unfixed> (embed)
514            NOTE: lib/fsplib version 0.3
515    
516    sprng
517            - tree-puzzle <unfixed> (embed)
518    
519    librpcsecgss
520            - krb5 <unfixed> (embed)
521    
522    jasper
523            - ghostscript 8.64~dfsg-2 (embed)
524    
525    libiris
526            - psi <unfixed> (embed)
527            - kdenetwork <unfixed> (embed)
528            NOTE: kopete embeds libiris but links dynamically to libidn
529            - kdegames <unfixed> (embed)
530            NOTE: ksirk/kde4
531    
532    libidn
533            - monotone 0.43-1 (embed)
534            - psi <unfixed> (embed)
535            NOTE: psi embeds libiris which embeds libidn
536            - kdegames <unfixed> (embed)
537            NOTE: kdegames/kde4 embeds libiris which embeds libidn
538    
539    liblua
540            - monotone 0.43-1 (embed)
541            - nmap 5.00-1 (embed; bug #527997)
542            [lenny] - nmap <unfixed> (embed; bug #527997)
543            - ocropus <unfixed> (embed)
544            - enigma <unfixed> (embed)
545            NOTE: requires lua built with C++
546            - freeciv <unfixed> (embed)
547    
548    libbotan
549            - monotone 0.43-1 (embed)
550    
551    NetXX
552            - monotone 0.43-1 (embed)
553    
554    libgc
555            - mono <unfixed> (embed)
556    
557    lzma
558            - p7zip <unfixed> (embed)
559            - xz-utils <unfixed> (fork)
560    
561    lzo
562            - grub2 <unfixed> (embed)
563    
564    yassl
565            - mysql-dfsg-5.0 <unfixed> (embed)
566    
567    pax code
568            - tar <unfixed> (embed)
569            - cpio <unfixed> (embed)
570    
571    t1lib
572            - tetex-bin 2.0.2-1 (embed)
573            - texlive-bin <unknown> (embed)
574    
575    guichan
576            - boswars <unfixed> (embed)
577            NOTE: maintainer notified us, working on it
578    
579    tolua
580            - boswars <unfixed> (embed)
581            NOTE: maintainer notified us, working on it
582            NOTE: actually tolua++
583            - ocropus <unfixed> (embed)
584            NOTE: actually tolua++
585            - freeciv <unfixed> (embed)
586            NOTE: actually tolua++
587            - enigma <unfixed> (embed)
588    
589  uw-imap:  asio-dev
590  pine          - luxrender <removed> (embed)
591    
592  imagemagick:  xine-lib
593  graphicsmagick          - vlc <unfixed> (embed)
594            NOTE: only parts included in modules/access/rtsp
595    
596  halibut:  netpbm
597  nsis          - tcl8.3 <unfixed> (embed)
598            - tcl8.4 <unfixed> (embed)
599            - tcl8.5 <unfixed> (embed)
600            NOTE: generic/tkImgGIF.c
601    
602    tk8.5
603            - tk8.0 <removed> (old-version)
604            - tk8.3 <unfixed> (old-version)
605            - tk8.4 <unfixed> (old-version)
606            - perl-tk <unfixable> (fork)
607    
608    samba
609            - mc 2:4.6.2~git20080311-1 (embed)
610            NOTE: maintainer is aware of this, currently searching a solution
611    
612    plib1.8.4c2
613            - boson <unfixed> (fork)
614            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
615    
616    fribidi
617            - quesoglc <unfixed> (embed)
618            NOTE: compiled against system fribidi in Debian - embed only used when fribidi is not available on the system
619    
620    glew
621            - quesoglc <unfixed> (embed; bug #489341)
622            NOTE: waiting on GLEW_MX version of glew (see bug #474488)
623            - trigger <unfixed> (embed)
624            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
625            - trigger-rally <unfixed> (embed)
626            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
627    
628    minorGems (pabs contacted upstream about shared lib, he considers minorGems an 'ever-evolving collection of reusable code fragments' for his own use)
629            - transcend <unfixed> (embed)
630            - cultivation <unfixed> (embed)
631            - passage <unfixed> (embed)
632            - gravitation <unfixed> (embed)
633    
634    tar
635            - libarchive <unfixed> (embed)
636            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
637    
638    cpio
639            - libarchive <unfixed> (embed)
640            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
641    
642    webkit
643            - qt4-x11 <unfixed> (embed; bug #479851)
644            - kdelibs <unfixed> (old-version)
645            - kde4libs <unfixed> (fork)
646    
647    ftgl
648            - blender 2.46+dfsg-1 (embed)
649    
650    wv
651            - abiword <unfixed>
652    
653    qemu
654            - kvm <unfixed> (embed; bug #543159)
655            NOTE: the kvm package will be removed from sid and squeeze soon (after
656            NOTE: which it will only be in experimental). superceded by qemu-kvm.
657            - qemu-kvm <unfixed> (embed; bug #560853)
658            - xen-3 3.4.2-2 (embed; bug #560856)
659            - xen-unstable <unfixed> (embed; bug #560856)
660    
661    vgabios
662            - kvm <unfixed> (embed; bug #489442)
663    
664    bochs
665            - kvm <unfixed> (embed; bug #489442)
666    
667    speex
668            - vorbis-tools <unfixed> (embed)
669            NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
670            - gst-plugins-good0.10 <unfixed> (embed)
671            - xine-lib <unfixed> (embed)
672            - libfishsound <unfixed> (embed)
673            - libannodex <removed> (embed)
674            - vlc <unfixed> (embed)
675            - xmms-speex <unfixed> (embed)
676            - libsdl-sound1.2 <unfixed> (embed)
677            - sweep <unfixed> (embed)
678    
679    libreadline
680            - magic <itp> (old-version)
681    
682    opcode
683            - ode <unfixed> (embed)
684            NOTE: opcode is not a package in debian, it is just embedded
685            NOTE: http://www.codercorner.com/Opcode.htm
686    
687    gimpact
688            - ode <unfixed> (embed)
689            NOTE: gimpact is not a package in debian, it is just embedded
690            NOTE: http://gimpact.sf.net
691    
692    mochikit
693            - mahara <unfixed> (embed)
694            NOTE: they require extra patches, still unmerged upstream
695            - ntop <unfixed> (embed)
696            - coherence 0.6.2-1 (embed)
697            - paste <unfixed> (embed)
698            - turbogears <unfixed> (embed)
699            - plone3 <unfixed> (embed)
700            - xulrunner <unfixed> (embed)
701            - libjifty-plugin-chart-perl <unfixed> (embed)
702            - sabnzbdplus <unfixed> (embed)
703            - tgmochikit <unfixed> (embed)
704    
705    prototypejs
706            - netbeans-ide 6.0.1+dfsg-2 (embed)
707            - auth2db 0.2.5-2+dfsg-1 (embed; bug #555218)
708            - webcit <unfixed> (embed; bug #555219)
709            - asterisk 1:1.6.2.0~rc3-1 (embed)
710            - libjson-ruby 1.1.4-1 (embed; bug #555224)
711            - lucene2 2.9.1+ds1-2 (embed; bug #555226)
712            - horde3 <unfixed> (embed)
713            - knowledgeroot <unfixed> (embed; bug #555230)
714            - mediatomb <unfixed> (embed; bug #555233)
715            - mt-daapd 0.9~r1696.dfsg-6lenny2 (embed)
716            - ebug-http <unfixed> (embed; bug #555236)
717            - libaws 2.7-1 (embed; bug #555222)
718            - phpgedview <removed> (embed)
719            - poker-network <unfixed> (embed; bug #555238)
720            - rails 2.1.0-6 (embed)
721            - wordpress 2.5.0-2 (embed; bug #555243)
722            - zope <not-affected> (the prototypejs embed is not in any of the obvious zope packages, e.g. zope2.9, zope2.10, zope2.11, and zope3)
723            TODO: search through all of the other zope packages
724            - ampache 3.4.1-2 (embed)
725            - exaile 0.2.14+debian-2.1 (embed; bug #555245)
726            - hobix 0.5~svn20070319-4 (embed; bug #555247)
727            - zabbix 1.6.6-4 (embed; bug #555250)
728            - chora2 <unfixed> (embed; bug #555253)
729            - gollem <unfixed> (embed; bug # 555254)
730            - jscropperui 1.2.1-1 (embed; bug #555257)
731            - scriptaculous <not-affected> (uses system prototype.js since initial upload; bug #555260)
732            - ingo1 <unfixed> (embed; bug #555261)
733            - kronolith2 <unfixed> (embed; bug #555262)
734            - activeldap <unfixed> (embed)
735            - libv8 <not-affected> (contains a google-specific implementation of prototype.js)
736            - mantis <unfixed> (embed; bug #555265)
737            - otrs2 2.3.4-6 (embed; bug #555267)
738            - webcalendar <unfixed> (embed; bug #555269)
739            - redmine 0.9.0~svn2907-1 (embed; bug #555270)
740            - jifty 0.90519-1 (embed; bug #555271)
741            - jquery <unfixed> (embed; bug #555272)
742            - passenger 2.2.5debian1-1 (embed; bug #555273)
743            - plone3 <unfixed> (embed; bug #555275)
744            - wesnoth <not-affected> (prototype.js not included in any of the binary packages; bug #555277)
745            - libhtml-prototype-perl 1.48-3 (embed; bug #538920)
746            - xulrunner <unfixed> (embed)
747            NOTE: included in iceweasel/xulrunner unit tests directory, so may not be security-relevant
748    
749    gdb
750            - insight <unfixed> (embed)
751    
752    e2fsprogs
753            - ldiskfsprogs <unfixable> (fork)
754    
755    quazip (not packaged in Debian)
756            - qcake <unfixed> (embed)
757            NOTE: starting with upstream version 0.6.4
758    
759    exo
760            - pcmanfm <unfixed> (embed; bug #499677)
761            NOTE: slightly modified source code
762    
763    java
764            - openjdk-6 <unfixed>
765            - sun-java5 <unfixed>
766            - sun-java6 <unfixed>
767    
768    libphp-snoopy
769            - ampache 3.4.1-2 (embed; bug #504169)
770            - gforge 4.6.99+svn6094-2 (embed)
771            - mahara 1.0.5-2 (embed; bug #504170)
772            - pixelpost 1.7.1-5 (embed; bug #504171)
773            - mediamate 0.9.3.6-5 (embed; bug #504172)
774            - opendb <removed> (embed; bug #504173)
775            [etch] - opendb <unfixed> (embed; bug #504173)
776            - wordpress 2.5.1-9 (embed; bug #443948)
777            - moodle <unfixed> (embed; bug #507185)
778            [etch] - phpgroupware <unfixed> (embed)
779            NOTE: phpgroupware-felamimail
780            - magpierss 0.72-3 (embed; bug #431089)
781    
782    jquery
783            - zekr <unfixed> (embed)
784            - wordpress <unknown> (embed)
785            - yocto-reader <unfixed> (embed)
786            - textpattern <unfixed> (embed)
787            - genshi 0.5.1-1 (embed)
788            NOTE: compressed file under examples/ dir
789            - prewikka <unfixed> (embed)
790            - libramaze-ruby <unfixed> (embed)
791            - drupal5 <unfixed> (embed)
792            - b2evolution <unfixed> (embed)
793            - wesnoth <unfixed> (embed)
794    
795    tablesorter (jquery plugin, not packaged yet)
796            - wesnoth <unfixed> (embed)
797    
798    kses
799            - wordpress <unfixed> (embed; bug #504242)
800            NOTE: their copy has all methods renamed to wp_<foo>
801            NOTE: kses isn't in Debian, RFP: #504240
802            - moodle <unfixed> (embed; bug #507185)
803            - egroupware <unfixed> (embed)
804    
805    magpierss
806            - wordpress <unfixed> (embed; bug #504242)
807            - moodle <unfixed>
808    
809    php-gettext
810            - wordpress 2.8.4-1 (embed; bug #504242)
811    
812    libphp-ixr (name may change, it is the Incutio XML-RPC)
813            - wordpress <unfixed> (embed; bug #504242)
814            NOTE: libphp-ixr isn't in Debian, RFP: #504236
815            - dokuwiki <unfixed> (embed)
816            - textpattern <unfixed> (embed)
817    
818    libphp-cas
819            - glpi <unfixed> (embed)
820            - moodle <unfixed> (embed; bug #505984)
821    
822    scriptaculous (prototype.js is among the embeds in the following)
823            - glpi <unfixed> (embed)
824            - libaws <unfixed> (embed; bug #555222)
825            - op-panel <unfixed> (embed)
826            - symfony <unfixed> (embed)
827            NOTE: maintainer says there are extra incompatible changes required
828            - pixelpost 1.7.1-6 (embed)
829            - webhelpers <unfixed> (embed)
830            - qwik <removed> (embed; bug #555241)
831            - smokeping <unfixed> (embed)
832            - turba2 <unfixed> (embed)
833            - typo3-src 4.2.3-1 (embed)
834            - request-tracker3.6 <unfixed> (embed)
835            - request-tracker3.8 <unfixed> (embed)
836            - rt-extension-emailcompletion <not-affected> (prototype.js not included in the binary package)
837            - wordpress 2.5.0-2 (embed)
838            - libhtml-prototype-perl 1.48-3 (embed)
839    
840    libmarkdown-php
841            - moodle <unfixed> (embed; bug #507185)
842            - pixelpost 1.7.1-6 (embed)
843    
844    php-openid
845            - wordpress-openid <itp> (embed)
846    
847    geshi
848            - dokuwiki 0.0.20080505-3.1 (embed)
849            - pgfouine 1.0-1.1 (embed)
850            - websvn 2.1.0-1 (embed)
851    
852    webcalendar
853            - gforge 4.7~rc2-6 (embed; bug #504758)
854    
855    libical
856            - kdepim <unfixed> (fork)
857            - kdepimlibs <unfixed> (fork)
858            NOTE: fixed in KDE4 post 4.1.x series
859            - claws-mail-extra-plugins <unfixed> (fork)
860    
861    libltdl3
862            - kdelibs <unfixed> (embed)
863            NOTE: it's been said it sets RT_GLOBAL (or something like that) at runtime and version in experimental of libltdl can optionally set it
864            - synfig <unfixed> (embed)
865    
866    harfbuzz
867            - qt4-x11 <unfixed> (embed)
868    
869    libzip
870            - php5 <unfixable> (modified-embed)
871            - odt2txt <unfixed> (embed; bug #523808)
872    
873    json.php (not packaged; should be replaced with php's built-in functions)
874            - moodle <unfixed>
875            - yui <unfixed>
876            - gallery2 <unfixed>
877            - dokuwiki <unfixed>
878            - typo3-src <unfixed>
879    
880    php-fpdf
881            - tcpdf <itp> (fork)
882            - moodle <unfixed>
883            - phpwiki <unfixed>
884            - egroupware <unfixed>
885            - ldap-account-manager <unfixed> (fork)
886    
887    tcpdf (itp: #495985)
888            - moodle <unfixed>
889            - phpmyadmin <unfixed>
890    
891    typo3
892            - moodle <unfixed>
893    
894    spreadsheet_writeexcel (PHP port of libspreadsheet-writeexcel-perl; itp: #487557)
895            - moodle <unfixed>
896            - gosa <unfixed>
897    
898    php-ole (itp: #487558)
899            - moodle <unfixed>
900    
901    pieforms (http://www.catalyst.net.nz)
902            - mahara <unfixed>
903    
904    savant2 (http://phpsavant.com)
905            - egroupware <unfixed>
906    
907    rssparser (http://nwow.org)
908            - egroupware <unfixed>
909            - phpgroupware <unfixed>
910    
911    lcms
912            - openjdk-6 <unfixed> (fork)
913    
914    libphp-phplayersmenu
915            - diogenes <unfixed>
916            - phpldapadmin <unfixed>
917    
918    libphp-pclzip
919            - docvert <unfixed>
920            - moodle <unfixed>
921            - egroupware <unfixed>
922    
923    libphp-simplepie
924            - dokuwiki <unfixed>
925    
926    libphp-jpgraph
927            - egroupware <unfixed>
928    
929    php-simpletest
930            - moodle <unfixed>
931    
932    libpng
933            - iceweasel <not-affected> (uses xulrunner)
934            - icedove 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1, 2.0.0.19-1 (embed)
935            - iceape 1.0.13~pre080614i-0etch1 (embed)
936            - xulrunner 1.9.0.13-1 (embed)
937            [lenny] - xulrunner 1.9.0.11-0lenny1
938            [etch] - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
939            - gamera 3.2.3-1 (embed)
940    
941    irssi
942            - silc-client <unfixed> (embed)
943            NOTE: Seems to be a pre-0.8.12 version that is used in irssi-plugin-silc
944    
945    extc
946            - mtasc <unfixed> (embed)
947            - haxe <unfixed> (embed)
948    
949    swflib
950            - mtasc <unfixed> (embed)
951            - haxe <unfixed> (embed)
952    
953    libitext-java
954            - bouncycastle 2.1.4-1 (embed)
955    
956    python-ply
957            - pyke <unfixed> (embed; bug #555363)
958            - pywbem <unfixed> (embed; bug #555364)
959            - sepolgen <unfixed> (embed; bug #555365)
960            - zope-textindexng3 <unknown> (embed)
961            - iceweasel <not-affected> (uses xulrunner)
962            - xulrunner <unknown> (embed)
963            - wireshark <not-affected> (python-ply modules are not installed into binary packages; see #554613)
964    
965    libdumbnet (libdnet upstream)
966            - nmap <unfixed> (fork)
967    
968    gcc-4.4
969            - gcc-mingw32 <unfixed> (embed)
970    
971    camlimages
972            - advi <unfixed> (static; bug #550441)
973    
974    memcached
975            - memcachedb <unfixed> (embed)
976    
977    yajl
978            - argyll <unfixed> (embed; bug #544223)
979            NOTE: reference, confirmed by build logs: http://lists.debian.org/debian-mentors/2009/08/msg00062.html
980    
981    nusoap
982            - gforge 4.8.2-1 (embed)
983    
984    libept
985            - adept <unfixed> (embed; bug #540649)
986    
987    libvorbis
988            - iceweasel <not-affected> (uses xulrunner)
989            - xulrunner <unfixed> (embed; bug #540959)
990            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
991            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
992            - iceape <unfixed> (embed)
993            [etch] - iceape <not-affected> (introduced in 2.0)
994            [lenny] - iceape <not-affected> (introduced in 2.0)
995    
996    cairo
997            - iceweasel <not-affected> (uses xulrunner)
998            - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
999    
1000    liboggz
1001            - iceweasel <not-affected> (uses xulrunner)
1002            - xulrunner <unfixed> (embed; bug #540959)
1003            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1004            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1005            - iceape <unfixed> (embed)
1006            [etch] - iceape <not-affected> (introduced in 2.0)
1007            [lenny] - iceape <not-affected> (introduced in 2.0)
1008    
1009    liboggplay
1010            - iceweasel <not-affected> (uses xulrunner)
1011            - xulrunner <unfixed> (embed; bug #540959)
1012            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1013            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1014            - iceape <unfixed> (embed)
1015            [etch] - iceape <not-affected> (introduced in 2.0)
1016            [lenny] - iceape <not-affected> (introduced in 2.0)
1017    
1018    php-net-dnsbl
1019            - serendipity <unfixed> (embed)
1020    
1021    php-onyx-rss
1022            - serendipity <unfixed> (embed)
1023    
1024    php-text-wiki
1025            - serendipity <unfixed> (embed)
1026    
1027    php-xml-rpc
1028            - serendipity <unfixed> (embed)
1029    
1030    polarssl (does not have a shared library)
1031            - pdkim <itp> (embed; bug #543150)
1032            - xyssl <unfixed> (old-version)
1033    
1034    pidgin
1035            - gaim <removed> (old-version)
1036            - qutecom <unfixed> (embed; bug #559785)
1037    
1038    icu
1039            - webkit 1.0.1-1 (embed; bug #547214)
1040            - texlive-bin <unfixed> (fork)
1041            NOTE: texlive upstream working with icu upstream to merge their changes
1042    
1043    cyrus-imapd-2.2
1044            - kolab-cyrus-imapd <unfixed> (fork)
1045            - dovecot 1:1.2.1-1 (embed) [/dovecot-sieve/src/libsieve/*]
1046    
1047    python-cxx-dev
1048            - freecad 0.9.2646.3-1 (embed; bug #547936)
1049    
1050    zipios++
1051            - freecad 0.9.2646.3-1 (embed; bug #547941)
1052            - enigma 0.92.3-3 (embed)
1053            NOTE: likely fixed earlier, marking etch's version as fixed
1054    
1055    linux-2.6
1056            - kvm <unfixed> (embed; bug #549973) [./kernel/*]
1057            - linux-kbuild-2.6 <unfixed> (embed; bug #550379) [./kbuild/*]
1058            - kernel-source-2.6.8 <removed> (old-version)
1059            - kernel-source-2.4.27 <removed> (old-version)
1060            - kernel-source-2.4.24 <removed> (old-version)
1061            - kernel-source-2.2.25 <removed> (old-version)
1062            - kernel-source-2.2.20 <removed> (old-version)
1063    
1064    libfdt (not yet packaged separately for debian; http://www.jdl.com/software/)
1065            - kvm <unfixed> (embed) [./libfdt/*]
1066    
1067    qweb (not packaged)
1068            - ajaxterm <unfixed>
1069    
1070    opensaml2
1071            - opensaml <removed> (old-version)
1072    
1073    shibboleth-sp2
1074            - shibboleth-sp <removed> (old-version)
1075    
1076    tuxonice-userui
1077            - suspend2-userui <removed> (old-version)
1078    
1079    expat
1080            - w3c-libwww <removed> (embed; bug #551941)
1081            [etch] - w3c-libwww <unfixed> (embed; bug #551941) [./modules/expat/*]
1082            - python-xml <unfixed> (embed; bug #551940) [./extensions/expat/*]
1083            - python2.5 <unfixable> (embed; bug #553403) [./Modules/expat/*]
1084            - python2.4 <unfixable> (embed; bug #553403)
1085            - python-4suite <unfixed> (embed; bug #516935)
1086            - wxwindows2.4 <removed> (embed)
1087            - wxwidgets2.6 2.6.3.2.2-4 (embed)
1088            - wxwidgets2.8 2.8.10.1-2 (embed)
1089            - celementtree 1.0.5-8 (embed)
1090            NOTE: Maybe that was fixed even earlier
1091            - audacity 1.3.2-1 (embed)
1092            - matanza <unfixed> (embed)
1093            - tdom <unfixed> (embed)
1094            - udunits 2.1.8-4 (embed)
1095            - apr-util 1.2 (embed)
1096            - ayttm <unfxed> (embed; bug #561006)
1097            - cableswig <unfixed> (embed)
1098            - cadaver <unfixed> (embed)
1099            - cmake 2.6.0-6 (embed)
1100            - coin3 <unfixed> (embed)
1101            - gdcm 2.0.14-2 (embed)
1102            - ghostscript <unfixed> (embed)
1103            - grmonitor <unfixed> (embed)
1104            - iceape <unfixed> (embed)
1105            - insighttoolkit 3.16.0-1 (embed)
1106            NOTE: insighttoolkit might've been fixed earlier
1107            - libparagui1.1 <unfixed> (embed)
1108            - paraview <unfixed> (embed)
1109            - poco <unfixed> (embed)
1110            - simgear <unfixed> (embed)
1111            - sitecopy 1:0.16.0-1
1112            - smart 1.0-1 (embed)
1113            - swish-e <unfixed> (embed)
1114            - tla <unfixed> (embed)
1115            - vtk 4.1.20030227-1 (embed)
1116            - wbxml2 <unfixed> (embed)
1117            - xmlrpc-c <unfixed> (embed)
1118            - iceweasel <unfixed> (embed)
1119            - kompozer <unfixed> (embed)
1120            - vxl 1.13.0-2 (embed)
1121            - xulrunner <unfixed> (embed)
1122            - apache2 2.2 (embed)
1123            - texlive-bin <not-affected> (Embedded code not compiled in)
1124            - vnc4 <unfixed> (embed)
1125            - xotcl <unfixed> (embed)
1126    
1127    xerces-c
1128            - xerces-c2 <unfixed> (old-version)
1129            - xerces27 <removed> (old-version)
1130    
1131    md5 (RSA's version; not the gnu version provided by coreutils)
1132            - w3c-libwww <removed> (embed; bug #551942)
1133            [etch] - w3c-libwww <unfixed> (embed; bug #551942) [./modules/md5/*]
1134    
1135    enet
1136            - sauerbraten <unfixed> (embed; #497194)
1137    
1138    eglibc
1139            - glibc <removed> (old-version)
1140    
1141    galib
1142            - gamera 3.2.3-1 (embed)
1143    
1144    configobj
1145            - bzr <unfixed> (embed; bug #555336)
1146            - elisa <unfixed> (embed; bug #555337)
1147            - gaupol <unfixed> (embed; bug #555338)
1148            - ipython <unfixed> (embed; bug #555339)
1149            - pida <unfixed> (embed; bug #555340)
1150            - psychopy <unfixed> (embed; bug #555341)
1151            - rest2web <unfixed> (embed; bug #555342)
1152            - auth2db <unknown> (embed)
1153            - dynagen <unknown> (embed)
1154            - iceweasel <unknown> (embed)
1155            - sabnzbdplus <unknown> (embed)
1156            - xulrunner <unknown> (embed)
1157            - nipy <not-affected> (part of an example [/examples/neurospin/neurospy/configobj.py], which is not installed into binary packages)
1158    
1159    python-clientform
1160            - bibus <unfixed> (embed; bug #555332)
1161            - zope2.10 <unfixed> (embed; bug #555333)
1162            - zope2.11 <unfixed> (embed; bug #555334)
1163            - python-mechanize <unknown> (embed)
1164            - twill <unknown> (embed)
1165    
1166    python-mechanize
1167            - zope2.10 <unfixed> (embed; bug #555337)
1168            - zope2.11 <unfixed> (embed; bug #555338)
1169            - twill <unknown> (embed; bug #555339)
1170    
1171    pexpect
1172            - duplicity 0.6.06-1 (embed; bug #555361)
1173            - hplip <unfixed> (embed; bug #555362)
1174            - smart <unfixed> (embed; bug #555363)
1175    
1176    pyparsing
1177            - bauble <unfixed> (embed; bug #555366)
1178            - boa-constructor 0.6.1-8 (embed; bug #555367)
1179            - calibre <unfixed> (embed; bug #555368)
1180            - matplotlib <unfixed> (embed; bug #531024)
1181            - zhpy <unfixed> (embed; bug #555370)
1182            - polybori <unknown> (embed)
1183            - python-whoosh <unknown> (embed)
1184            - twill <unknown> (embed)
1185            - zope-textindexng3 <unknown> (embed)
1186    
1187    python-pysqlite2
1188            - python2.4 <unfixed> (embed; bug #553403)
1189            - python2.5 <unfixed> (embed; bug #553403)
1190    
1191    celementtree
1192            - python2.5 <unfixed> (embed)
1193            - smart 1.0-1 (embed)
1194            [etch] - smart <unfixed> (embed)
1195    
1196    elementtree
1197            - python2.5 <unfixed> (embed)
1198            - bzr <unfixed> (embed; bug #555343)
1199            - gedit 2.28.2-1 (embed; bug #555344)
1200            - smart 1.0-1 (embed)
1201            [etch] - smart <unfixed> (embed)
1202            - solfege <unfixed> (embed; bug #555345)
1203            - w3af <unfixed> (embed; bug #555346)
1204            - python-qt4 <unknown> (embed)
1205            - sphinx <unknown> (embed)
1206            - python-nltk <itp> (embed)
1207    
1208    python2.5
1209            - python2.4 <unfixed> (old-version)
1210            - jython <unfixed> (embed)
1211            NOTE: embeds many stdlib modules
1212            - python-django <unfixed> (embed; bug #555419)
1213            NOTE: embeds stdlib modules: doctest, decimal
1214            - gamera 3.2.3-1 (embed)
1215            NOTE: embeds stdlib modules: ConfigParser, optparse, sets, textwrap
1216            - boa-constructor <unfixed> (embed; bug #555426)
1217            NOTE: embeds stdlib modules: ConfigParser, tarfile, zipfile, xmlrpclib
1218            - nicotine <unfixed> (embed; bug #555427)
1219            NOTE: embeds stdlib modules: ConfigParser
1220            - museek+ <unfixed> (embed; bug #555428)
1221            NOTE: embeds stdlib modules: ConfigParser
1222            - vegastrike-data <unfixed> (embed)
1223            NOTE: embeds many stdlib modules
1224            - codespeak-lib 1.1.1-1 (embed; bug #555420)
1225            NOTE: embeds stdlib modules: doctest, optparse, subprocess, textwrap
1226            - config-manager <unfixed> (embed; bug #555423)
1227            NOTE: embeds stdlib modules: optparse
1228            - jhbuild 2.28.0-1 (embed; bug #555421)
1229            NOTE: embeds stdlib modules: optparse, subprocess
1230            - smart <unfixed> (embed; bug #555432)
1231            NOTE: embeds stdlib modules: optparse
1232            - pyprotocols 1.0a.svn20070625-5 (embed; bug #555433)
1233            NOTE: embeds stdlib modules: doctest
1234            - ruledispatch 0.5a.svn20080510-4 (embed; bug #555434)
1235            NOTE: embeds stdlib modules: doctest
1236            - distribute <unfixed> (embed)
1237            NOTE: embeds stdlib modules: doctest
1238            - python-setuptools <unfixed> (embed; bug #555435)
1239            NOTE: embeds stdlib modules: doctest
1240            - zope.testing <unfixed> (embed; bug #555436)
1241            NOTE: embeds stdlib modules: doctest
1242            - translate-toolkit <unfixed> (embed; bug #555422)
1243            NOTE: embeds stdlib modules: textwrap, contextlib
1244            - libtpclient-py <unfixed> (embed; bug #555424)
1245            NOTE: embeds stdlib modules: subprocess
1246            - grass <unfixed> (embed; bug #555425)
1247            NOTE: embeds stdlib modules: subprocess
1248            - coherence <unfixed> (embed; bug #555429)
1249            NOTE: embeds stdlib modules: uuid
1250            - python-django-extensions 0.4.2pre+git200911182050-1 (embed; bug #555430)
1251            NOTE: embeds stdlib modules: uuid
1252            - setroubleshoot <unfixed> (embed; bug #555431)
1253            NOTE: embeds stdlib modules: uuid
1254            - linkchecker <unfixed> (embed; bug #555414)
1255            NOTE: embeds msgfmt.py script
1256            - imdbpy <unfixed> (embed)
1257            NOTE: embeds msgfmt.py script
1258            - kiwi <unfixed> (embed)
1259            NOTE: embeds msgfmt.py script
1260            - moin <unfixed> (embed)
1261            NOTE: embeds msgfmt.py script, stdlib modules: cgitb, difflib, tarfile
1262            - plone3 <unfixed> (embed)
1263            NOTE: embeds msgfmt.py script
1264            - roundup <unfixed> (embed)
1265            NOTE: embeds msgfmt.py script, stdlib modules: cgitb
1266            - rednotebook <unfixed> (embed; bug #555415)
1267            NOTE: embeds msgfmt.py script
1268            - turbogears <unfixed> (embed)
1269            NOTE: embeds msgfmt.py script
1270            - elisa <unfixed> (embed)
1271            NOTE: embeds msgfmt.py script, stdlib modules: uuid
1272            - calibre <unfixed> (embed)
1273            NOTE: embeds msgfmt.py script, stdlib modules: zipfile
1274            - mailman <unfixed> (embed; #555416)
1275            NOTE: embeds msgfmt.py script
1276            - python-docutils <unknown> (embed)
1277            NOTE: embeds stdlib modules: optparse, textwrap
1278            - python-imaging <unknown> (embed)
1279            NOTE: embeds stdlib modules: doctest
1280            - python-mechanize <unknown> (embed)
1281            NOTE: embeds stdlib modules: doctest
1282            - twill <unknown> (embed)
1283            NOTE: embeds stdlib modules: subprocess
1284            - zeroc-ice <unknown> (embed)
1285            NOTE: embeds stdlib modules: subprocess
1286            - wxwidgets2.8 <unknown> (embed)
1287            NOTE: embeds stdlib modules: subprocess
1288            - cycle <unknown> (embed)
1289            NOTE: embeds msgfmt.py script
1290            - deluge <unknown> (embed)
1291            NOTE: embeds msgfmt.py script
1292            - opendict <unknown> (embed)
1293            NOTE: embeds msgfmt.py script
1294            - openerp-client <unknown> (embed)
1295            NOTE: embeds msgfmt.py script
1296            - rapidsvn <unknown> (embed)
1297            NOTE: embeds msgfmt.py script
1298            - wammu <unknown> (embed)
1299            NOTE: embeds msgfmt.py script
1300            - gaphor <unknown> (embed)
1301            NOTE: embeds msgfmt.py script
1302            - pida <unknown> (embed)
1303            NOTE: embeds msgfmt.py script
1304            - python-formencode <unknown> (embed)
1305            NOTE: embeds msgfmt.py script
1306            - duplicity <unfixed> (embed)
1307            NOTE: embeds stdlib module: urlparse, tarfile
1308            - pygopherd <unfixed> (embed)
1309            NOTE: embeds stdlib module: zipfile
1310    
1311    argparse
1312            - twill <unfixed> (embed; bug #555347)
1313            - ipython <unfixed> (embed; bug #555348)
1314    
1315    coherence
1316            - elisa <unfixed> (embed; bug #555335)
1317    
1318    simpletal
1319            - plastex <unfixed> (embed; bug #555371)
1320    
1321    flickrpc (not packaged in Debian, http://burtonini.com/bzr/flickrpc/)
1322            - postr <unfixed> (embed)
1323            - elisa <unfixed> (embed)
1324    
1325    simplegeneric (not packaged in Debian, http://pypi.python.org/pypi/simplegeneric)
1326            - apertium-tolk <unfixed> (embed)
1327            - ipython <unfixed> (embed)
1328            - virtaal <unfixed> (embed)
1329    
1330    distribute
1331            - setuptools <removed> (old-version)
1332    
1333    rails
1334            - jruby1.2 <unfixed> (embed) [./bench/rails/*]
1335            - libgettext-ruby <unfixed> (embed) [./samples/rails/*]
1336            - libopenid-ruby <unfixed> (embed) [./examples/rails_openid/*]
1337            - thin <unfixed> (embed) [./spec/rails_app/*]
1338            NOTE: this is a subdirectory of examples, which in general is a non-issue, but may
1339            NOTE: be dangerous if developers are naively basing their code off of the examples
1340            NOTE: prototype.js is among the example files
1341    
1342    lucene2 (prototype.js is among the embeds in the following)
1343            - lucene <unfixed> (old-version)
1344            - pylucene <unfixed> (embed)
1345            - libpdfbox-java <unfixed> (embed)
1346            - libfontbox-java <unfixed> (embed)
1347            - libjempbox-java <unfixed> (embed)
1348            - solr <unfixed> (embed)
1349    
1350    unicode-data
1351            - syslinux <unfixed> (embed)
1352            - camomile <unfixed> (embed)
1353            - fribidi <unfixed> (embed)
1354            - m17n-db <unfixed> (embed)
1355            - sbcl <unfixed> (embed)
1356            - heimdal <unfixed> (embed)
1357            - icu <unfixed> (embed)
1358            - icu4j <unfixed> (embed)
1359            - krb5 <unfixed> (embed)
1360            - moodle <unfixed> (embed)
1361            - openldap <unfixed> (embed)
1362            - pike7.6 <unfixed> (embed)
1363            - samba <unfixed> (embed)
1364            - samba4 <unfixed> (embed)
1365            - cmucl <unfixed> (embed)
1366            - typo3-src <unfixed> (embed)
1367            - mauve <unfixed> (embed)
1368            - texlive-bin <unfixed> (embed)
1369            - ypsilon <unfixed> (embed)
1370            - jeuclid <unfixed> (embed)
1371            - charmap.app <unfixed> (embed)
1372            - clisp <unfixed> (embed)
1373            - gnulib <unfixed> (embed)
1374            - opensrs-client <unfixed> (embed)
1375            - saxonb <unfixed> (embed)
1376            - rails <unfixed> (embed)
1377    
1378    feedparser
1379            - rawdog <unfixed> (embed; bug #383422)
1380            - miro <unfixed> (embed; bug #555351)
1381            - calibre <unfixed> (embed; bug #555352)
1382            - freevo <unfixed> (embed; bug #555353)
1383            - pida <unfixed> (embed; bug #555354)
1384            - planet-venus <unfixed> (embed; bug #555355)
1385            - plone3 <unfixed> (embed; bug #555356)
1386            - exaile 0.2.14+debian-1 (embed)
1387            - screenlets 0.1.2-3 (embed)
1388            NOTE: included twice
1389    
1390    agg:
1391            - matplotlib <unfixed> (embed: bug #377271)
1392            - contextfree <unfixed> (embed)
1393            NOTE: since 2.2-1 it links statically to system libagg, but still uses the embedded copy
1394            - exactimage <unfixed> (embed)
1395            - python-enable <unfixed> (embed)
1396            - mapnik 0.5.1-3 (embed)
1397            NOTE: links statically to agg, but shared library is not available (bug #377271)
1398    
1399    vtk
1400            - paraview <unfixable> (embed; bug #495426)
1401    
1402    txt2tags
1403            - rednotebook <unfixed> (embed)
1404    
1405    htmltextview (not packaged in Debian, http://www.gnome.org/~gjc/htmltextview.py)
1406            - gajim <unfixed> (embed)
1407            - emesene <unfixed> (embed)
1408            - convirt <unfixed> (embed)
1409            - pida <unfixed> (embed)
1410            - rednotebook <unfixed> (embed)
1411    
1412    horde3 (prototype.js is among the embeds in the following)
1413            - mnemo2 <unfixed> (embed)
1414            - nag2 <unfixed> (embed)
1415    
1416    cimg
1417            - gmic <itp> (embed)
1418    
1419    mootools
1420            - gmic <itp> (embed)
1421    
1422    openldap
1423            - openldap2.3 <removed> (old-version)
1424    
1425    grub2
1426            - grub <unfixed> (old-version)
1427    
1428    gnupginterface
1429            - duplicity <unfixed> (embed)
1430    
1431    python-dateutil
1432            - awn-extras-applets <unfixed> (embed)
1433            - matplotlib <unknown> (embed)
1434    
1435    cups
1436            - cupsys <removed> (old-version)
1437    
1438    yui
1439            - bcfg2 <not-affected> (present in source but not included in any binary files)
1440            - serendipity <unfixed> (embed; bug #557746)
1441            - moodle 1.8.2.dfsg-5 (embed)
1442            - jifty 0.91117-1 (embed; bug #557748)
1443            - webgui 7.7.26-1 (embed)
1444            - loggerhead 1.17-1 (embed)
1445    
1446    quake3 (vanilla source not packaged in debian)
1447            - openarena <unfixable> (fork)
1448    
1449    quake2 (vanilla source not packaged in debian)
1450            - alien-arena <unfixable> (fork)
1451            - warsow <unfixable> (fork)
1452    
1453    libtheora
1454            - iceweasel <not-affected> (uses xulrunner)
1455            - xulrunner <unfixed> (embed; bug #540959)
1456            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1457            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1458            - iceape <unfixed> (embed; bug #559276)
1459            [etch] - iceape <not-affected> (introduced in iceape 2.0)
1460            [lenny] - iceape <not-affected> (introduced in iceape 2.0)
1461    
1462    dtoa
1463            - bfilter <unfixed> (embed)
1464            - cacao <unfixed> (embed)
1465            - cdrdao <unfixed> (embed)
1466            - classpath <unfixed> (embed)
1467            - freej <unfixed> (embed)
1468            - iceape <unfixed> (embed)
1469            - iceweasel <unfixed> (embed)
1470            - jscoverage <unfixed> (embed)
1471            - kde4libs <unfixed> (embed)
1472            - kdelibs <unfixed> (embed)
1473            - kompozer <unfixed> (embed)
1474            - libv8 <unfixed> (embed)
1475            - mono <unfixed> (embed)
1476            - newlib <unfixed> (embed)
1477            - nspr <unfixed> (embed)
1478            - php5 <unfixed> (embed)
1479            - polyml <unfixed> (embed)
1480            - qt4-x11 <unfixed> (embed)
1481            - rhino <unfixed> (embed)
1482            NOTE: code translated to Java
1483            - ruby1.8 <unfixed> (embed)
1484            - ruby1.9 <unfixed> (embed)
1485            - ruby1.9.1 <unfixed> (embed)
1486            - sdd <unfixed> (embed)
1487            - sfind <unfixed> (embed)
1488            - star <unfixed> (embed)
1489            - tinymux <unfixed> (embed)
1490            - virtualbox-ose <unfixed> (embed)
1491            - webkit <unfixed> (embed)
1492            - xulrunner <unfixed> (embed)
1493    
1494    ipc (not packaged in Debian; see http://mozdev.org/pipermail/enigmail/2009-November/011678.html)
1495            - firegpg <unfixed> (embed)
1496            - enigmail <unfixed> (embed)
1497    
1498    ptmalloc (not packaged in Debian)
1499            - crystalspace <unfixed> (embed)
1500            - qt4-x11 <unfixed> (embed)
1501    
1502    svgalib
1503            - usplash <unfixed> (embed)
1504    
1505    bogl
1506            - usplash <unfixed> (embed)
1507    
1508    taglist
1509            - usplash <unfixed> (embed)
1510    
1511    portaudio
1512            - audacity <unfixed> (embed; bug #323711)
1513    
1514    nyquist
1515            - audacity <unfixed> (embed)
1516            NOTE: embeds a forked nyquist with support for a shared library
1517    
1518  libghttp:  vamp-plugin-sdk
1519  hotway          - audacity <unfixed> (embed)
1520    
1521  etl-dev (will be renamed to libetl-dev soon):  wordpress
1522  synfig          - libwordpress-xmlrpc-perl <removed> (embed) [./xmlrpc.php]
1523    
1524  libmms:  php5
1525  xine-lib          - php4 <removed> (old-version)
 mimms  
1526    
1527  FCKeditor:  classpath
1528  knowledgeroot          - libgnucrypto-java <unfixed> (embed; bug #559788)
1529    
1530  Moodle contains lots of things:  libtool
1531  AdoDB          - apr <unfixed> (static; bug #489625)
1532  AdoDB-XML Schema          NOTE: ships copy of libtool in libapr1-dev; was 'embed' before 1.3.2-3
1533  ipatlas          - arts <unfixed> (embed)
1534  PHPMailer          - bochs <unfixed> (embed; bug #560884)
1535  Smarty          - camserv <unfixed> (embed)
1536  htmlArea          - collectd <unfixed> (embed)
1537  TinyMCE          - courier-authlib 0.58-4 (embed)
1538  bennu          NOTE: The etch version of courier-authlib was the earliest version checked, might be fixed earlier
1539            - cvsnt <unfixed> (embed)
1540            - dico <not-affected> (Uses the system copy of ltdl)
1541            - freeradius 0.1+20010527-1 (embed)
1542            NOTE: Earliest reference I could find from the changelog is from 27 May 2001
1543            - ggobi 2.1.9~20091212-1 (embed)
1544            - glame <unfixed> (embed)
1545            - gnash <unfixed> (embed)
1546            - gnu-smalltalk <unfixed> (embed)
1547            - google-gadgets <unfixed> (embed)
1548            - graphicsmagick 1.3.5-6 (embed)
1549            - graphviz 2.8-3 (embed)
1550            NOTE: The etch version of graphviz was the earliest version checked, might be fixed earlier
1551            - guile-1.6 1.6.8-7 (embed)
1552            - hamlib <unfixed> (embed)
1553            - hercules <unfixed> (embed)
1554            - jags 1.0.4-3 (embed; bug #560864)
1555            - kdelibs <unfixed> (embed)
1556            - libannodex <removed> (embed)
1557            - libextractor <unfixed> (embed)
1558            - libmcrypt <not-affected> (libtool source present but not included in any of the binary packages)
1559            - libtunepimp <unfixed> (embed)
1560            - mp4h <unfixed> (embed)
1561            - naim <unfixed> (embed)
1562            - parser-mysql <unfixed> (embed)
1563            - pinball <unfixed> (embed)
1564            - redland <unfixed> (embed)
1565            - siproxd <unfixed> (embed)
1566            - ski <unfixed> (embed)
1567            - synfig <unfixed> (embed)
1568            - unixodbc 2.2.4-5 (embed)
1569            - xmlsec1 <not-affected> (Doesn't enable dynamic loading of crypto modules)
1570            - clamav 0.95+dfsg-1 (embed)
1571            - imagemagick <unfixed> (embed)
1572            - hypre 2.4.0b-5 (embed)
1573            - lam <unfixed> (embed)
1574            - openmpi <unfixable> (embed; bug #559386)
1575            - parser <unfixed> (embed)
1576            - pdsh <unfixed> (embed; bug #560892)
1577            - sbnc 1.2-8 (embed)
1578            - sdcc <unfixed> (embed)
1579            - wml <unfixed> (embed)
1580            - proftpd-dfsg <unfixed> (embed; bug #561748)
1581            - babel 1.4.0.dfsg-5 (embed)
1582            - libprelude 0.9.14-2 (embed)
1583            - heartbeat 2.1.4-7 (embed)
1584            NOTE: From Squeeze onwards the system copy of ltdl is used, use the current version from Squeeze,
1585            NOTE: might've been fixed earlier
1586            - gcc-* <unknown> (embed)
1587    
1588    ocamlgsl
1589            - orpie 1.5.1-7.1 (embed; bug #550058)
1590    
1591  TinyMCE:  xdotool
1592  wordpress          - keynav <unfixed> (embed; bug #560103)
 moodle  
 knowledgeroot  
 joomla (ITP)  
   
 scintilla:  
 scite  
 qscintilla  
 geany  
   
 libphp-adodb:  
 gallery2  
 phppgadmin  
 egroupware  
 phpwiki  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
   
 gzip:  
 linux-kernel (lib/inflate.c)  
 klibc (based on linux-kernel gzip code)  
 busybox  
   
 ffmpeg:  
 mplayer (#395252)  
   
 neon:  
 cadaver (all, but being worked on: #188381)  
 gnome-vfs2 (#395874)  
 litmus (#395875)  
 screem (sarge only)  
 sitecopy (#395876)  
 tla (etch/sid only: #395877)  
   
 libmodplug:  
 gst-plugins-bad0.10  
   
 libvncserver:  
 vino  
   
 putty:  
 filezilla  
   
 tinyxml (not packaged in Debian):  
 filezilla  
   
 gv:  
 evince (ps/ tree from gv 3.5.8)  
 evince-gtk (not packaged in Debian)  
   
 libXbae:  
 libpawlib2-lesstif package (from Cernlib)  
1593    
1594  libXaw:  bulletphysics (not packaged; http://www.bulletphysics.org/)
1595  libpawlib2-lesstif package (from Cernlib)          - supertuxkart <unfixed> (embed)
1596    
1597  (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  ghostscript
1598            - gs-gpl <removed> (old-version)
1599    
1600  libgd2:  icedove
1601  graphviz (lib/gd seems to be 2.0.33)          - thunderbird <removed> (old-version)

Legend:
Removed from v.5321  
changed lines
  Added in v.13608

  ViewVC Help
Powered by ViewVC 1.1.5