/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 6146 by stef-guest, Mon Jul 16 20:56:04 2007 UTC revision 8346 by nion, Sun Mar 16 16:13:21 2008 UTC
# Line 1  Line 1 
1  This file collects cases, where a source package embeds code from  Embedded code copies
2  other projects, without linking dynamically:  ====================
3    
4  xpdf code: (some use xpdf 2, some xpdf 3)  This file collects source packages that embed code from other projects.
5  gpdf (will be replaced by evince in Gnome 2.12)  This is considered bad for fixing security flaws because the fix needs
6  pdftohtml (current poppler source package has a ported version, pinged maintainer)  to be applied in multiple source packages.
7  kdegraphics/kpdf (upstream is working on using poppler, probably not in time for Etch)  
8  tetex-bin (links to poppler since 3.0-12)  Format:
9  cupsys (only older releases, recent ones use xpdf-utils, it's still present in the src, though)  <srcpkg> (<optional comment about srcpkg>)
10  poppler          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11  koffice/kword (upstream is working on using poppler, probably not in time for Etch)          NOTE: optional comments about the linkage of the embedding srcpkg
12  libextractor (uses internal pdf decoder since 0.5.12-1)  
13  pdfkit.framework (links to poppler since 0.8-4)  status: version number fixing the embedded copy, <unfixed>, <removed>,
14  ipe (only small parts, but with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp)          <itp> or <unknown> if the version number can not be determined
15            <unfixable> for unavoidable cases (e.g., forks that add real value)
16  zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  sort: static (linking statically against a lib)
17  dpkg        embed (embedding a copy of the library into another source package)
18  rsync (somehow derived code base)        fork (the package is not just embedding code but it is a fork and
19  mozilla(?)              thus might share parts of the source code)
20  Linux kernels        old-version (the package is an older version of essentially
21  pvpgn (links dynamically since 1.7.8-2)                     the same code)
22  mrtg (links dynamically since 2.12.2-1)  
23  rpm  The srcpkg might be some string to identify the code if there is no
24    specific source package.
25  libbz2:  
26  dpkg (statically linked)  Everything up to the next line is ignored.
27    ---BEGIN
28  libgadu/ekg:  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29  centericq          NOTE: Fixed packages link to poppler library unless otherwise noted
30  gaim          - gpdf <removed>
31  kopete (ships the code, but links dynamically in the Debian package)          [sarge] - gpdf <unfixed>
32  kadu (not packaged in Debian)          NOTE: has been replaced by evince in etch
33  GNU gadu (not yet packaged in Debian)          - pdftohtml <unknown>
34            [sarge] - pdftohtml <unfixed>
35  xmlrpc: (which package is the "origin" of this code?)          [etch] - pdftohtml <unfixed>
36  drupal          NOTE: has been replaced by poppler-utils
37  phpgroupware          - kdegraphics <unfixed> (embed; bug #436164)
38  egroupware          NOTE: the kpdf replacement in KDE 4 is using poppler
39  phpwiki          - tetex-bin 3.0-12 (embed)
40  php4 (php-pear, IIRC this was reorganized some weeks ago?)          - texlive-bin 2007-1 (embed)
41  tikiwiki          NOTE: links to poppler
42            - koffice <unfixed> (embed; bug #436163)
43  shtool: (affects build-time only)          - libextractor 0.5.12-1 (embed)
44  mysql-ocaml          NOTE: libextractor is using its own pdf decoder now
45  php4          - libextractor 0.5.12-1 (embed)
46            - pdfkit.framework 0.8-4 (embed)
47  mozilla:          - ipe <unfixed> (embed)
48  mozilla-firefox          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
49  mozilla-thunderbird          - ruby-gnome2 <unknown> (embed)
50  firefox (to be removed)          NOTE: copy only present in source but links to poppler
51  thunderbird (to be removed)  
52  iceweasel  ppmd
53  iceape          - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
54  icedove  
55  xulrunner  peercast
56  nvu (no longer in Debian)          - gnome-peercast <unfixed> (embed)
57            NOTE: gnome-peercast may better be removed, see #466539
58  xli:  
59  xloadimage  silc-toolkit
60            - silc-client 1.1~beta6-1 (embed)
61  lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)  
62  openmotif  dietlibc
63  xfree86/xorg (in libxpm)          - ccontrol 0.9.1+20071204-1 (static)
64    
65  kerberized apps with BSD origin:  libiax
66  krb4          - iaxmodem <unfixed> (embed)
67  krb5  
68  heimdal  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
69            - dpkg <unfixed> (embed)
70  grip: (which pkg is the origin?)          NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
71  libcdaudio          - rsync <unfixed> (embed)
72  grip          NOTE: somehow derived code base
73  gnome-vfs (vfs2 as well?)          - mono <unfixed> (embed)
74            TODO: check mozilla
75  fudforum:          - Linux kernels <unfixed> (embed)
76  phpgroupware-fudforum          - pvpgn 1.7.8-2 (embed)
77  egroupware-fudforum (removed from egroupware after sarge)          - mrtg 2.12.2-1 (embed)
78            - rpm <unknown> (embed)
79  cvs:          NOTE: pinged anibal since when rpm was fixed
80  gcvs (at least an additional script is included, check if there's more)  
81    libbz2
82  pcre:          - dpkg <unfixed> (static)
83  all pythons  
84  php4 (src included, but Debian package links dynamically)  ekg
85  analog (src included, but Debian package links dynamically)          - centericq <unfixed> (embed)
86  libgoffice-1          - gaim <unfixed> (embed)
87  tf5 (since 5.0beta7 the Debian package links dynamically)          - pigdin <unfixed> (embed)(links dynamically against libgadu)
88            - kopete 4:3.3.2-5 (embed)
89  tiff:          - kadu <unfixed> (embed)
90  wxpythongtk (check, which debian pkg this is in)          - gadu <unfixed> (embed)
91  older kdegraphics/kpdf releases < 3.3 embedded a copy          NOTE: g/kadu not packaged in Debian yet
92    
93  uudeview:  xmlrpc (which package is the "origin" of this code?)
94  libconvert-uulib-perl          - drupal <unfixed> (embed)
95            - phpgroupware <unfixed> (embed)
96  sqlite: (not affected by security vulnerabilities so far)          - egroupware <unfixed> (embed)
97  amarok          - phpwiki (embed)
98            - php4 <unfixed> (embed)
99  util-linux/mount:          TODO: check, php-pear, IIRC this was reorganized some weeks ago?
100  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb  
101    shtool (affects build-time only)
102  webmin:          - mysql-ocaml <unfixed> (embed)
103  usermin (only in sarge)          - php4 <unfixed> (embed)
104    
105  sylpheed:  mozilla source code
106  sylpheed-claws          - mozilla-firefox <unfixed> (embed)
107            - mozilla-thunderbird
108  phpsysinfo:          - firefox <removed>
109  egroupware          [etch] - firefox <unfixed> (embed)
110  phpgroupware          - thunderbird <removed>
111            [etch] - thunderbird <unfixed> (embed)
112            - iceweasel <unfixed> (embed)
113            - iceape <unfixed> (embed)
114            - icedove <unfixed> (embed)
115            - xulrunner <unfixed> (embed)
116            - nvu <removed> (embed)
117    
118    xli
119            - xloadimage <unfixed> (embed)
120    
121    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
122            - openmotif <unfixed> (embed)
123            - xfree86/xorg <unfixed> (embed)
124            NOTE: in libxpm
125    
126    kerberized apps with BSD origin
127            - krb4 <unfixed> (embed)
128            - krb5 <unfixed> (embed)
129            - heimdal <unfixed> (embed)
130    
131    grip (which pkg is the origin?)
132            - libcdaudio
133            - grip
134            - gnome-vfs
135            TODO: check vfs2 as well
136    
137    fudforum
138            - phpgroupware-fudforum <unfixed> (embed)
139            - egroupware-fudforum <removed>
140            [sarge] - egroupware-fudforum <unfixed> (embed)
141    
142    cvs
143            - gcvs <unfixed> (embed)
144            NOTE: see cvsunix/src in tarball
145    
146    pcre
147            - python* <unfixed> (embed)
148            - php4 <unknown> (embed)
149            - analog 2:5.23-0woody1 (embed)
150            - libgoffice-1 <unfixed> (embed)
151            - vfu 4.06-4.1 (embed; bug #450754)
152            - tf5 5.0beta7-1 (embed)
153            - monotone <unfixed> (embed)
154            NOTE: this only affects versions >= 0.37
155            - glib <unfixed> (embed)
156            NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic
157            - apache2 2.0.53-4 (embed)
158            - exim4 4.10-0.srh20.12 (embed)
159            - yacas <unfixed> (embed)
160            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
161            - gtamsanalyzer.app 0.42-5 (embed)
162    
163    tiff
164            - wxpythongtk <unfixed> (embed)
165            TODO: check, which debian pkg this is in
166    
167    uudeview
168            - libconvert-uulib-perl <unfixed> (embed)
169    
170    sqlite (not affected by security vulnerabilities so far)
171            - amarok <unfixed> (embed)
172            - monotone <unfixed> (embed)
173            - iceweasel <unfixed> (embed)
174    
175    util-linux/mount
176            - loop-aes-utils <unfixed> (embed)
177            NOTE: contains code from util-linux' mount in the mount-aes-udeb
178    
179    webmin
180            - usermin <unknown> (embed)
181            [sarge] - usermin <unfixed> (embed)
182    
183    sylpheed
184            - sylpheed-claws <unfixed> (fork)
185    
186    phpsysinfo
187            - egroupware <unfixed> (embed)
188            - phpgroupware <unfixed> (embed)
189    
190    phpldapadmin
191            [sarge] - egroupware <unfixed> (embed)
192            NOTE: removed from egroupware after sarge
193    
194    chmlib
195            - kchmviewer <unknown> (embed)
196    
197    libavcodec/libavformat (source: ffmpeg)
198            - mplayer <unfixed> (embed; bug #395252)
199            - xvidcap <unfixed> (embed)
200            - kino <unfixed> (static)
201            - vlc <unfixed> (static)
202            - smilutils <unfixed> (static)
203            - motion <unfixed> (static)
204            - gst-ffmpeg <unfixed> (embed)
205            - gstreamer0.10-ffmpeg <unfixed> (embed)
206            - xmovie <unfixed>
207            TODO: gimp-gap (potentially using ffmpeg code as well)
208    
209    mad MPEG decoding lib
210            - mad <unfixed> (embed)
211            - xine-lib <unfixed> (embed)
212    
213  phpldapadmin:  libdts
214  egroupware (removed from egroupware after sarge)          - xine-lib <unfixed> (embed)
215    
216  chmlib:  flac
217  kchmviewer (not packaged in Debian)          - xine-lib <unfixed> (embed)
218    
219  libavcodec/libavformat:  liba52
220  ffmpeg          - a52dec <unfixed> (embed)
221  xine-lib          - xine-lib <unfixed> (embed)
 xvidcap  
 kino (links statically, does not include code)  
 vlc (links statically, does not include code)  
 smilutils (links statically, does not include code)  
 motion (links statically, does not include code)  
 gst-ffmpeg  
 gstreamer0.10-ffmpeg  
 xmovie  
222    
223  mad MPEG decoding lib:  libmpeg2
224  mad          - mpeg2dec <unfixed> (embed)
225  xine-lib          - xine-lib <unfixed> (embed)
226    
227  libdts:  curl
228  libdts          - wget <unfixed> (embed)
229  xine-lib          NOTE: code for NTLM authentication
230    
231  flac:  uw-imap
232  flac          - pine <unfixed> (embed)
233  xine-lib          - alpine <unfixed> (embed)
234    
235  liba52:  imagemagick
236  a52dec          - graphicsmagick <unfixed> (fork)
 xine-lib  
237    
238  libmpeg2:  halibut
239  mpeg2dec          - nsis <unfixed> (embed)
 xine-lib  
240    
241  curl:  libghttp
242  wget (code for NTLM authentication)          - hotway <unfixed> (embed)
243    
244  TODO evaluate:  libsndfile
245  gimp-gap (potentially using ffmpeg code as well)          - ardour <unfixed> (embed)
246    
247  uw-imap:  glibmm2.4
248  pine          - ardour <unfixed> (embed)
249    
250  imagemagick:  libgnomecanvasmm2.6
251  graphicsmagick          - ardour <unfixed> (embed)
252    
253  halibut:  libsigc++-2.0
254  nsis          - ardour <unfixed> (embed)
255    
256  libghttp:  soundtouch
257  hotway          - ardour <unfixed> (embed)
258    
259  etl-dev (will be renamed to libetl-dev soon):  libmms
260  synfig          - xine-lib <unfixed> (embed)
261            - mimms <unfixed> (embed)
262    
263  libmms:  fckeditor
264  xine-lib          - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
265  mimms          - moin <unfixed> (embed; bug #452599)
266            - karrigell <unfixed> (embed; bug #452598)
267            - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
268    
269    ipatlas (not packaged in Debian)
270            - moodle <unfixed> (embed)
271    
272    libphp-phpmailer
273            - moodle <unfixed> (embed)
274    
275  FCKeditor:  htmlArea (not packaged in Debian)
276  knowledgeroot          - moodle <unfixed> (embed)
277    
278    giflib:
279            - wine <unfixed> (embed; bug #466181)
280    
281    bennu (not packaged in Debian)
282            - moodle <unfixed> (embed)
283    
284    smarty:
285            - moodle <unfixed> (embed; bug #471158)
286            - gallery2 <unfixed> (embed; bug #471160)
287            - mahara <unfixed> (embed; bug #471201)
288            - gosa <unfixed> (embed; bug #471200)
289    
 Moodle contains lots of things:  
 AdoDB  
 AdoDB-XML Schema  
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
290  TinyMCE  TinyMCE
291  bennu          - wordpress <unfixed> (embed)
292            - moodle <unfixed> (embed)
293            - knowledgeroot <unfixed> (embed)
294            - joomla <itp> (bug #326398)
295    
296    scintilla
297            - scite <unfixed> (embed)
298            - qscintilla <unfixed> (embed)
299            - qscintilla2 <unfixed> (embed)
300            - geany <unfixed> (embed)
301    
302    libphp-adodb
303            - moodle <unfixed> (embed)
304            NOTE: also AdoDB-XML Schema
305            - gallery2 <unfixed> (embed)
306            - phppgadmin <unfixed> (embed)
307            - egroupware <unfixed> (embed)
308            - phpwiki <unfixed> (embed)
309            - ipplan <unfixed> (embed)
310            - typo3 <unfixed> (embed)
311            - moodle <unfixed> (embed)
312            - cacti <unknown> (embed)
313            [sarge] - cacti <unfixed> (embed)
314            NOTE: dependency exists, but internal version is used
315    
316    gzip
317            - linux-kernel <unfixed> (embed)
318            NOTE: lib/inflate.c
319            - klibc <unfixed> (embed)
320            NOTE: based on linux-kernel gzip code
321            - busybox <unfixed> (embed)
322    
323    neon
324            - cadaver <unfixed> (embed; bug #188381)
325            - gnome-vfs2 <unfixed> (embed; bug #395874)
326            - litmus <unfixed> (embed; #395875)
327            [sarge] - screem <unfixed> (embed)
328            - sitecopy <unfixed> (embed; bug #395876)
329            [etch] - tla <unfixed> (embed; bug #395877)
330            [sarge] - tla <unfixed> (embed; bug #395877)
331    
332    libmodplug
333            - gst-plugins-bad0.10 <unfixed> (embed)
334    
335    libvncserver
336            - vino <unfixed> (embed)
337    
338    putty
339            - filezilla <unfixed> (embed)
340    
341    tinyxml (not packaged in Debian)
342            - filezilla <unfixed>
343    
344    gv
345            - evince <unfixed> (embed)
346            NOTE: ps/ tree from gv 3.5.8
347            - evince-gtk <unfixed> (embed)
348            NOTE: not packaged in Debian
349    
350    libXbae
351            [etch] - libpawlib2-lesstif <unfixed> (embed)
352            NOTE: from Cernlib
353    
354    libXaw
355            [etch] - libpawlib2-lesstif
356            NOTE: from Cernlib
357            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
358    
359    libgd2
360            - graphviz <unfixed> (embed)
361            NOTE: lib/gd seems to be 2.0.33
362            - wml <unfixed> (embed)
363            NOTE: derived from gd 1.6.3
364    
365    rar
366            - unrar-nonfree <unfixed> (embed)
367    
368    unrar-free (maybe this code is derived from the original rar, too?)
369            - clamav <unfixed> (embed)
370            NOTE: seems to be disabled in default config
371    
372    mplayer (DirectMedia Object loader)
373            - xine-lib <unfixed> (embed)
374            NOTE: src/libw32dll/
375            - vlc <unfixed> (embed)
376            NOTE: modules/codec/dmo/
377    
378    libwpd (WordPerfect converter)
379            - openoffice.org <unfixed> (embed)
380    
381    fsplib (http://sourceforge.net/projects/fsp/)
382            - gftp <unfixed> (embed)
383            NOTE: lib/fsplib version 0.3
384    
385    librpcsecgss
386            - krb5 <unfixed> (embed)
387    
388    jasper
389            - ghostscript <unfixed> (embed)
390            - gs-gpl <unfixed> (embed)
391    
392    libidn
393            - monotone <unfixed> (embed)
394    
395    liblua
396            - monotone <unfixed> (embed)
397    
398    libbotan
399            - montone <unfixed> (embed)
400    
401    NetXX
402            - monotone <unfixed> (embed)
403    
404    libgc
405            - mono <unfixed> (embed)
406    
407    lzma
408            - p7zip <unfixed> (embed)
409    
410    lzo
411            - grub2 <unfixed> (embed)
412    
413    yassl
414            - mysql-dfsg-5.0 <unfixed> (embed)
415    
416    pax code
417            - tar <unfixed> (embed)
418            - cpio <unfixed> (embed)
419    
420    t1lib
421            - tetex-bin 2.0.2-1 (embed)
422            - texlive-bin <unknown> (embed)
423    
424    guichan
425            - boswars <unfixed> (embed)
426            NOTE: maintainer notified us, working on it
427    
428    tolua
429            - boswars <unfixed> (embed)
430            NOTE: maintainer notified us, working on it
431    
432    asio-dev
433            - luxrender <unfixed> (embed)
434            NOTE: maintainer notified us, working on it
435            NOTE: may be merged with boost "soon"
436    
437  TinyMCE:  xine-lib
438  wordpress          - vlc <unfixed> (embed)
439  moodle          NOTE: only parts included in modules/access/rtsp
 knowledgeroot  
 joomla (ITP)  
   
 scintilla:  
 scite  
 qscintilla  
 geany  
   
 libphp-adodb:  
 gallery2  
 phppgadmin  
 egroupware  
 phpwiki  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
   
 gzip:  
 linux-kernel (lib/inflate.c)  
 klibc (based on linux-kernel gzip code)  
 busybox  
   
 ffmpeg:  
 mplayer (#395252)  
   
 neon:  
 cadaver (all, but being worked on: #188381)  
 gnome-vfs2 (#395874)  
 litmus (#395875)  
 screem (sarge only)  
 sitecopy (#395876)  
 tla (etch/sid only: #395877)  
   
 libmodplug:  
 gst-plugins-bad0.10  
   
 libvncserver:  
 vino  
   
 putty:  
 filezilla  
   
 tinyxml (not packaged in Debian):  
 filezilla  
   
 gv:  
 evince (ps/ tree from gv 3.5.8)  
 evince-gtk (not packaged in Debian)  
   
 libXbae:  
 libpawlib2-lesstif package (from Cernlib)  
   
 libXaw:  
 libpawlib2-lesstif package (from Cernlib)  
   
 (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  
   
 libgd2:  
 graphviz (lib/gd seems to be 2.0.33)  
   
 rar:  
 unrar-nonfree  
   
 unrar-free: (maybe this code is derived from the original rar, too?)  
 clamav (seems to be disabled in default config)  
   
 mplayer (DirectMedia Object loader):  
 xine-lib (src/libw32dll/)  
 vlc (modules/codec/dmo/)  
440    
441  libwpd (WordPerfect converter):  netpbm
442  openoffice.org          - tcl8.3 <unfixed> (embed)
443            - tcl8.4 <unfixed> (embed)
444            - tcl8.5 <unfixed> (embed)
445            NOTE: generic/tkImgGIF.c
446    
447    tk8.5
448            - tk8.0 <removed> (old-version)
449            - tk8.3 <unfixed> (old-version)
450            - tk8.4 <unfixed> (old-version)
451            - perl-tk <unfixable> (fork)
452    
453    samba
454            - mc <unfixed> (embed)
455            NOTE: maintainer is aware of this, currently searching a solution
456    
457    plib1.8.4c2
458            - boson <unfixed> (fork)
459            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar

Legend:
Removed from v.6146  
changed lines
  Added in v.8346

  ViewVC Help
Powered by ViewVC 1.1.5