/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 7054 by white, Sun Oct 21 15:02:04 2007 UTC revision 8175 by nion, Sun Feb 17 13:31:09 2008 UTC
# Line 1  Line 1 
1  This file collects cases, where a source package embeds code from  Embedded code copies
2  other projects, without linking dynamically:  ====================
3    
4  xpdf code: (some use xpdf 2, some xpdf 3)  This file collects source packages that embed code from other projects.
5  gpdf (has been replaced by evince - which uses poppler - in Etch)  This is considered bad for fixing security flaws because the fix needs
6  pdftohtml (has been replaced by poppler-utils from the poppler source package, still in Etch, though)  to be applied in multiple source packages.
7  kdegraphics/kpdf (okular, the kpdf replacement in KDE 4 is using poppler, #436164)  
8  tetex-bin (links to poppler since 3.0-12)  Format:
9  cupsys (uses xpdf-utils, it's still present in the src, though)  <srcpkg> (<optional comment about srcpkg>)
10  poppler          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11  koffice/kword (upstream is working on using poppler, #436163)          NOTE: optional comments about the linkage of the embedding srcpkg
12  libextractor (uses internal pdf decoder since 0.5.12-1)  
13  pdfkit.framework (links to poppler since 0.8-4)  status: version number fixing the embedded copy, <unfixed>, <removed>,
14  ipe (only small parts, but with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp)          <itp> or <unknown> if the version number can not be determined
15            <unfixable> for unavoidable cases (e.g., forks that add real value)
16  silc-toolkit:  sort: static (linking statically against a lib)
17  silc-client (uses libsilc and libsilcclient)        embed (embedding a copy of the library into another source package)
18          fork (the package is not just embedding code but it is a fork and
19  dietlibc:              thus might share parts of the source code)
20  ccontrol (links statically)        old-version (the package is an older version of essentially
21                       the same code)
22  libiax:  
23  iaxmodem  The srcpkg might be some string to identify the code if there is no
24    specific source package.
25  zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  
26  dpkg  Everything up to the next line is ignored.
27  rsync (somehow derived code base)  ---BEGIN
28  mozilla(?)  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29  Linux kernels          NOTE: Fixed packages link to poppler library unless otherwise noted
30  pvpgn (links dynamically since 1.7.8-2)          - gpdf <removed>
31  mrtg (links dynamically since 2.12.2-1)          [sarge] - gpdf <unfixed>
32  rpm          NOTE: has been replaced by evince in etch
33            - pdftohtml <unknown>
34  libbz2:          [sarge] - pdftohtml <unfixed>
35  dpkg (statically linked)          [etch] - pdftohtml <unfixed>
36            NOTE: has been replaced by poppler-utils
37  libgadu/ekg:          - kdegraphics <unfixed> (embed; bug #436164)
38  centericq          NOTE: the kpdf replacement in KDE 4 is using poppler
39  gaim          - tetex-bin 3.0-12 (embed)
40  kopete (ships the code, but links dynamically in the Debian package)          - texlive-bin 2007-1 (embed)
41  kadu (not packaged in Debian)          NOTE: links to poppler
42  GNU gadu (not yet packaged in Debian)          - koffice <unfixed> (embed; bug #436163)
43            - libextractor 0.5.12-1 (embed)
44  xmlrpc: (which package is the "origin" of this code?)          NOTE: libextractor is using its own pdf decoder now
45  drupal          - libextractor 0.5.12-1 (embed)
46  phpgroupware          - pdfkit.framework 0.8-4 (embed)
47  egroupware          - ipe <unfixed> (embed)
48  phpwiki          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
49  php4 (php-pear, IIRC this was reorganized some weeks ago?)          - ruby-gnome2 <unknown> (embed)
50  tikiwiki          NOTE: copy only present in source but links to poppler
51    
52  shtool: (affects build-time only)  ppmd
53  mysql-ocaml          - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
54  php4  
55    silc-toolkit
56  mozilla:          - silc-client 1.1~beta6-1 (embed)
57  mozilla-firefox  
58  mozilla-thunderbird  dietlibc
59  firefox (to be removed)          - ccontrol 0.9.1+20071204-1 (static)
60  thunderbird (to be removed)  
61  iceweasel  libiax
62  iceape          - iaxmodem <unfixed> (embed)
63  icedove  
64  xulrunner  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
65  nvu (no longer in Debian)          - dpkg <unfixed> (embed)
66            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
67  xli:          - rsync <unfixed> (embed)
68  xloadimage          NOTE: somehow derived code base
69            - mono <unfixed> (embed)
70  lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)          TODO: check mozilla
71  openmotif          - Linux kernels <unfixed> (embed)
72  xfree86/xorg (in libxpm)          - pvpgn 1.7.8-2 (embed)
73            - mrtg 2.12.2-1 (embed)
74  kerberized apps with BSD origin:          - rpm <unknown> (embed)
75  krb4          NOTE: pinged anibal since when rpm was fixed
76  krb5  
77  heimdal  libbz2
78            - dpkg <unfixed> (static)
79  grip: (which pkg is the origin?)  
80  libcdaudio  ekg
81  grip          - centericq <unfixed> (embed)
82  gnome-vfs (vfs2 as well?)          - gaim <unfixed> (embed)
83            - pigdin <unfixed> (embed)(links dynamically against libgadu)
84  fudforum:          - kopete 4:3.3.2-5 (embed)
85  phpgroupware-fudforum          - kadu <unfixed> (embed)
86  egroupware-fudforum (removed from egroupware after sarge)          - gadu <unfixed> (embed)
87            NOTE: g/kadu not packaged in Debian yet
88  cvs:  
89  gcvs (at least an additional script is included, check if there's more)  xmlrpc (which package is the "origin" of this code?)
90            - drupal <unfixed> (embed)
91  pcre:          - phpgroupware <unfixed> (embed)
92  all pythons          - egroupware <unfixed> (embed)
93  php4 (src included, but Debian package links dynamically)          - phpwiki (embed)
94  analog (src included, but Debian package links dynamically)          - php4 <unfixed> (embed)
95  libgoffice-1          TODO: check, php-pear, IIRC this was reorganized some weeks ago?
96  vfu  
97  tf5 (since 5.0beta7 the Debian package links dynamically)  shtool (affects build-time only)
98  monotone          - mysql-ocaml <unfixed> (embed)
99            - php4 <unfixed> (embed)
100  tiff:  
101  wxpythongtk (check, which debian pkg this is in)  mozilla source code
102  older kdegraphics/kpdf releases < 3.3 embedded a copy          - mozilla-firefox <unfixed> (embed)
103            - mozilla-thunderbird
104  uudeview:          - firefox <removed>
105  libconvert-uulib-perl          [etch] - firefox <unfixed> (embed)
106            - thunderbird <removed>
107  sqlite: (not affected by security vulnerabilities so far)          [etch] - thunderbird <unfixed> (embed)
108  amarok          - iceweasel <unfixed> (embed)
109  monotone          - iceape <unfixed> (embed)
110            - icedove <unfixed> (embed)
111  util-linux/mount:          - xulrunner <unfixed> (embed)
112  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb          - nvu <removed> (embed)
113    
114  webmin:  xli
115  usermin (only in sarge)          - xloadimage <unfixed> (embed)
116    
117  sylpheed:  lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
118  sylpheed-claws          - openmotif <unfixed> (embed)
119            - xfree86/xorg <unfixed> (embed)
120  phpsysinfo:          NOTE: in libxpm
121  egroupware  
122  phpgroupware  kerberized apps with BSD origin
123            - krb4 <unfixed> (embed)
124            - krb5 <unfixed> (embed)
125            - heimdal <unfixed> (embed)
126    
127    grip (which pkg is the origin?)
128            - libcdaudio
129            - grip
130            - gnome-vfs
131            TODO: check vfs2 as well
132    
133    fudforum
134            - phpgroupware-fudforum <unfixed> (embed)
135            - egroupware-fudforum <removed>
136            [sarge] - egroupware-fudforum <unfixed> (embed)
137    
138    cvs
139            - gcvs <unfixed> (embed)
140            NOTE: see cvsunix/src in tarball
141    
142    pcre
143            - python* <unfixed> (embed)
144            - php4 <unknown> (embed)
145            - analog 2:5.23-0woody1 (embed)
146            - libgoffice-1 <unfixed> (embed)
147            - vfu 4.06-4.1 (embed; bug #450754)
148            - tf5 5.0beta7-1 (embed)
149            - monotone <unfixed> (embed)
150            NOTE: this only affects versions >= 0.37
151            - glib <unfixed> (embed)
152            NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic
153            - apache2 2.0.53-4 (embed)
154            - exim4 4.10-0.srh20.12 (embed)
155            - yacas <unfixed> (embed)
156            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
157            - gtamsanalyzer.app 0.42-5 (embed)
158    
159    tiff
160            - wxpythongtk <unfixed> (embed)
161            TODO: check, which debian pkg this is in
162    
163    uudeview
164            - libconvert-uulib-perl <unfixed> (embed)
165    
166    sqlite (not affected by security vulnerabilities so far)
167            - amarok <unfixed> (embed)
168            - monotone <unfixed> (embed)
169            - iceweasel <unfixed> (embed)
170    
171    util-linux/mount
172            - loop-aes-utils <unfixed> (embed)
173            NOTE: contains code from util-linux' mount in the mount-aes-udeb
174    
175    webmin
176            - usermin <unknown> (embed)
177            [sarge] - usermin <unfixed> (embed)
178    
179    sylpheed
180            - sylpheed-claws <unfixed> (fork)
181    
182    phpsysinfo
183            - egroupware <unfixed> (embed)
184            - phpgroupware <unfixed> (embed)
185    
186    phpldapadmin
187            [sarge] - egroupware <unfixed> (embed)
188            NOTE: removed from egroupware after sarge
189    
190    chmlib
191            - kchmviewer <unknown> (embed)
192    
193    libavcodec/libavformat (source: ffmpeg)
194            - mplayer <unfixed> (embed; bug #395252)
195            - xvidcap <unfixed> (embed)
196            - kino <unfixed> (static)
197            - vlc <unfixed> (static)
198            - smilutils <unfixed> (static)
199            - motion <unfixed> (static)
200            - gst-ffmpeg <unfixed> (embed)
201            - gstreamer0.10-ffmpeg <unfixed> (embed)
202            - xmovie <unfixed>
203            TODO: gimp-gap (potentially using ffmpeg code as well)
204    
205    mad MPEG decoding lib
206            - mad <unfixed> (embed)
207            - xine-lib <unfixed> (embed)
208    
 phpldapadmin:  
 egroupware (removed from egroupware after sarge)  
   
 chmlib:  
 kchmviewer (not packaged in Debian)  
   
 libavcodec/libavformat:  
 ffmpeg  
 xine-lib  
 xvidcap  
 kino (links statically, does not include code)  
 vlc (links statically, does not include code)  
 smilutils (links statically, does not include code)  
 motion (links statically, does not include code)  
 gst-ffmpeg  
 gstreamer0.10-ffmpeg  
 xmovie  
   
 mad MPEG decoding lib:  
 mad  
 xine-lib  
   
 libdts:  
209  libdts  libdts
210  xine-lib          - xine-lib <unfixed> (embed)
211    
 flac:  
212  flac  flac
213  xine-lib          - xine-lib <unfixed> (embed)
   
 liba52:  
 a52dec  
 xine-lib  
   
 libmpeg2:  
 mpeg2dec  
 xine-lib  
214    
215  curl:  liba52
216  wget (code for NTLM authentication)          - a52dec <unfixed> (embed)
217            - xine-lib <unfixed> (embed)
218    
219  TODO evaluate:  libmpeg2
220  gimp-gap (potentially using ffmpeg code as well)          - mpeg2dec <unfixed> (embed)
221            - xine-lib <unfixed> (embed)
222    
223  uw-imap:  curl
224  pine          - wget <unfixed> (embed)
225  alpine          NOTE: code for NTLM authentication
226    
227  imagemagick:  uw-imap
228  graphicsmagick          - pine <unfixed> (embed)
229            - alpine <unfixed> (embed)
230    
231  halibut:  imagemagick
232  nsis          - graphicsmagick <unfixed> (fork)
233    
234  libghttp:  halibut
235  hotway          - nsis <unfixed> (embed)
236    
237  libsndfile:  libghttp
238  ardour          - hotway <unfixed> (embed)
239    
240  glibmm2.4:  libsndfile
241  ardour          - ardour <unfixed> (embed)
242    
243  libgnomecanvasmm2.6:  glibmm2.4
244  ardour          - ardour <unfixed> (embed)
245    
246  libsigc++-2.0:  libgnomecanvasmm2.6
247  ardour          - ardour <unfixed> (embed)
248    
249  soundtouch:  libsigc++-2.0
250  ardour          - ardour <unfixed> (embed)
251    
252  libmms:  soundtouch
253  xine-lib          - ardour <unfixed> (embed)
 mimms  
254    
255  FCKeditor:  libmms
256  knowledgeroot          - xine-lib <unfixed> (embed)
257  moin          - mimms <unfixed> (embed)
 karrigell  
   
 Moodle contains lots of things:  
 AdoDB  
 AdoDB-XML Schema  
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
 TinyMCE  
 bennu  
258    
259  TinyMCE:  fckeditor
260  wordpress          - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
261  moodle          - moin <unfixed> (embed; bug #452599)
262  knowledgeroot          - karrigell <unfixed> (embed; bug #452598)
263  joomla (ITP)          - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
264    
265  scintilla:  ipatlas (not packaged in Debian)
266  scite          - moodle <unfixed> (embed)
 qscintilla  
 geany  
267    
268  libphp-adodb:  libphp-phpmailer
269  gallery2          - moodle <unfixed> (embed)
 phppgadmin  
 egroupware  
 phpwiki  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
270    
271  gzip:  htmlArea (not packaged in Debian)
272  linux-kernel (lib/inflate.c)          - moodle <unfixed> (embed)
 klibc (based on linux-kernel gzip code)  
 busybox  
273    
274  ffmpeg:  giflib:
275  mplayer (#395252)          - wine <unfixed> (embed; bug #466181)
276    
277  neon:  bennu (not packaged in Debian)
278  cadaver (all, but being worked on: #188381)          - moodle <unfixed> (embed)
 gnome-vfs2 (#395874)  
 litmus (#395875)  
 screem (sarge only)  
 sitecopy (#395876)  
 tla (etch/sid only: #395877)  
279    
280  libmodplug:  smarty:
281  gst-plugins-bad0.10          - moodle <unfixed> (embed)
282    
283  libvncserver:  TinyMCE
284  vino          - wordpress <unfixed> (embed)
285            - moodle <unfixed> (embed)
286            - knowledgeroot <unfixed> (embed)
287            - joomla <itp> (bug #326398)
288    
289    scintilla
290            - scite <unfixed> (embed)
291            - qscintilla <unfixed> (embed)
292            - qscintilla2 <unfixed> (embed)
293            - geany <unfixed> (embed)
294    
295    libphp-adodb
296            - moodle <unfixed> (embed)
297            NOTE: also AdoDB-XML Schema
298            - gallery2 <unfixed> (embed)
299            - phppgadmin <unfixed> (embed)
300            - egroupware <unfixed> (embed)
301            - phpwiki <unfixed> (embed)
302            - ipplan <unfixed> (embed)
303            - typo3 <unfixed> (embed)
304            - moodle <unfixed> (embed)
305            - cacti <unknown> (embed)
306            [sarge] - cacti <unfixed> (embed)
307            NOTE: dependency exists, but internal version is used
308    
309    gzip
310            - linux-kernel <unfixed> (embed)
311            NOTE: lib/inflate.c
312            - klibc <unfixed> (embed)
313            NOTE: based on linux-kernel gzip code
314            - busybox <unfixed> (embed)
315    
316    neon
317            - cadaver <unfixed> (embed; bug #188381)
318            - gnome-vfs2 <unfixed> (embed; bug #395874)
319            - litmus <unfixed> (embed; #395875)
320            [sarge] - screem <unfixed> (embed)
321            - sitecopy <unfixed> (embed; bug #395876)
322            [etch] - tla <unfixed> (embed; bug #395877)
323            [sarge] - tla <unfixed> (embed; bug #395877)
324    
325    libmodplug
326            - gst-plugins-bad0.10 <unfixed> (embed)
327    
328    libvncserver
329            - vino <unfixed> (embed)
330    
331    putty
332            - filezilla <unfixed> (embed)
333    
334    tinyxml (not packaged in Debian)
335            - filezilla <unfixed>
336    
337    gv
338            - evince <unfixed> (embed)
339            NOTE: ps/ tree from gv 3.5.8
340            - evince-gtk <unfixed> (embed)
341            NOTE: not packaged in Debian
342    
343    libXbae
344            [etch] - libpawlib2-lesstif <unfixed> (embed)
345            NOTE: from Cernlib
346    
347    libXaw
348            [etch] - libpawlib2-lesstif
349            NOTE: from Cernlib
350            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
351    
352    libgd2
353            - graphviz <unfixed> (embed)
354            NOTE: lib/gd seems to be 2.0.33
355            - wml <unfixed> (embed)
356            NOTE: derived from gd 1.6.3
357    
358    rar
359            - unrar-nonfree <unfixed> (embed)
360    
361    unrar-free (maybe this code is derived from the original rar, too?)
362            - clamav <unfixed> (embed)
363            NOTE: seems to be disabled in default config
364    
365    mplayer (DirectMedia Object loader)
366            - xine-lib <unfixed> (embed)
367            NOTE: src/libw32dll/
368            - vlc <unfixed> (embed)
369            NOTE: modules/codec/dmo/
370    
371    libwpd (WordPerfect converter)
372            - openoffice.org <unfixed> (embed)
373    
374    fsplib (http://sourceforge.net/projects/fsp/)
375            - gftp <unfixed> (embed)
376            NOTE: lib/fsplib version 0.3
377    
378    librpcsecgss
379            - krb5 <unfixed> (embed)
380    
381    jasper
382            - ghostscript <unfixed> (embed)
383            - gs-gpl <unfixed> (embed)
384    
385  putty:  libidn
386  filezilla          - monotone <unfixed> (embed)
387    
388  tinyxml (not packaged in Debian):  liblua
389  filezilla          - monotone <unfixed> (embed)
390    
391  gv:  libbotan
392  evince (ps/ tree from gv 3.5.8)          - montone <unfixed> (embed)
 evince-gtk (not packaged in Debian)  
393    
394  libXbae:  NetXX
395  libpawlib2-lesstif package (from Cernlib)          - monotone <unfixed> (embed)
396    
397  libXaw:  libgc
398  libpawlib2-lesstif package (from Cernlib)          - mono <unfixed> (embed)
399    
400  (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  lzma
401            - p7zip <unfixed> (embed)
402    
403  libgd2:  lzo
404  graphviz (lib/gd seems to be 2.0.33)          - grub2 <unfixed> (embed)
405    
406  rar:  yassl
407  unrar-nonfree          - mysql-dfsg-5.0 <unfixed> (embed)
408    
409  unrar-free: (maybe this code is derived from the original rar, too?)  pax code
410  clamav (seems to be disabled in default config)          - tar <unfixed> (embed)
411            - cpio <unfixed> (embed)
412    
413  mplayer (DirectMedia Object loader):  t1lib
414  xine-lib (src/libw32dll/)          - tetex-bin 2.0.2-1 (embed)
415  vlc (modules/codec/dmo/)          - texlive-bin <unknown> (embed)
416    
417  libwpd (WordPerfect converter):  guichan
418  openoffice.org          - boswars <unfixed> (embed)
419            NOTE: maintainer notified us, working on it
420    
421  fsplib (http://sourceforge.net/projects/fsp/):  tolua
422  gftp (lib/fsplib version 0.3)          - boswars <unfixed> (embed)
423            NOTE: maintainer notified us, working on it
424    
425  librpcsecgss:  asio-dev
426  krb5          - luxrender <unfixed> (embed)
427            NOTE: maintainer notified us, working on it
428            NOTE: may be merged with boost "soon"
429    
430  jasper:  xine-lib
431  ghostscript          - vlc <unfixed> (embed)
432  gs-gpl          NOTE: only parts included in modules/access/rtsp
433    
434  monotone embeds lots of things:  netpbm
435  liblua          - tcl8.3 <unfixed> (embed)
436  libidn          - tcl8.4 <unfixed> (embed)
437  libsqlite3          - tcl8.5 <unfixed> (embed)
438  libbotan          NOTE: generic/tkImgGIF.c
439  NetXX  
440  pcre (starting from 0.37)  tk8.5
441            - tk8.0 <removed> (old-version)
442            - tk8.3 <unfixed> (old-version)
443            - tk8.4 <unfixed> (old-version)
444            - perl-tk <unfixable> (fork)

Legend:
Removed from v.7054  
changed lines
  Added in v.8175

  ViewVC Help
Powered by ViewVC 1.1.5