/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 7695 by nion, Sat Dec 22 16:01:32 2007 UTC revision 15413 by jmm-guest, Sun Oct 3 20:43:54 2010 UTC
# Line 1  Line 1 
1  Embedded code copies  Embedded code copies
2  ====================  ====================
3    
4  This file collects cases, where a source package embeds code from  This file collects source packages that embed code from other projects.
5  other projects which is considered bad for fixing security flaws  This is considered bad for fixing security flaws because the fix needs
6  because the fix needs to be applied in multiple source packages.  to be applied in multiple source packages.
7    
8  Format:  Format:
9  <srcpkg> (<optional comment about srcpkg>)  <srcpkg> (<optional comment about srcpkg>)
10          - <embedding srcpkg> <status> (<sort>; bug #<number>)          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11          NOTE: optional comments about the linkage of the embedding srcpkg          NOTE: optional comments about the linkage of the embedding srcpkg
12    
13  xpdf code: (some use xpdf 2, some xpdf 3)  status: version number fixing the embedded copy
14  gpdf (has been replaced by evince - which uses poppler - in Etch)          <unfixed> if the issue is not yet fixed
15  pdftohtml (has been replaced by poppler-utils from the poppler source package, still in Etch, though)          <removed> if the package was removed from the archive
16  kdegraphics/kpdf (okular, the kpdf replacement in KDE 4 is using poppler, #436164)          <itp> if the package is in the process of being packaged
17  tetex-bin (links to poppler since 3.0-12)          <not-affected> if the package does not use the embedded copy
18  texlive-bin (links to poppler)          <unknown> if the version number can not be determined
19  cupsys (uses xpdf-utils, it's still present in the src, though)          <unfixable> for unavoidable cases (e.g., forks that add real value)
20  poppler  sort: static (linking statically against a lib)
21  koffice/kword (upstream is working on using poppler, #436163)        embed (embeds a copy of the library into another source package)
22  libextractor (uses internal pdf decoder since 0.5.12-1)        modified-embed (embeds a code copy that differs from upstream code)
23  pdfkit.framework (links to poppler since 0.8-4)        fork (a full-blown fork of another source package)
24  ipe (only small parts, but with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp)        old-version (an older version of essentially the same code)
 ruby-gnome2 (has a copy of poppler but links against the shared lib)  
   
 silc-toolkit:  
 silc-client (uses libsilc and libsilcclient)  
   
 dietlibc:  
 ccontrol (links statically)  
   
 libiax:  
 iaxmodem  
   
 zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  
 dpkg  
 rsync (somehow derived code base)  
 mono  
 mozilla(?)  
 Linux kernels  
 pvpgn (links dynamically since 1.7.8-2)  
 mrtg (links dynamically since 2.12.2-1)  
 rpm  
   
 libbz2:  
 dpkg (statically linked)  
   
 libgadu/ekg:  
 centericq  
 gaim  
 pigdin (links dynamically against libgadu)  
 kopete (ships the code, but links dynamically in the Debian package)  
 kadu (not packaged in Debian)  
 GNU gadu (not yet packaged in Debian)  
   
 xmlrpc: (which package is the "origin" of this code?)  
 drupal  
 phpgroupware  
 egroupware  
 phpwiki  
 php4 (php-pear, IIRC this was reorganized some weeks ago?)  
   
 shtool: (affects build-time only)  
 mysql-ocaml  
 php4  
   
 mozilla:  
 mozilla-firefox  
 mozilla-thunderbird  
 firefox (to be removed)  
 thunderbird (to be removed)  
 iceweasel  
 iceape  
 icedove  
 xulrunner  
 nvu (no longer in Debian)  
25    
26  xli:  The srcpkg might be some string to identify the code if there is no
27  xloadimage  specific source package.
28    
29  lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)  Everything up to the next line is ignored.
30  openmotif  ---BEGIN
31  xfree86/xorg (in libxpm)  poppler
32            - pdftohtml <unknown>
33  kerberized apps with BSD origin:          [sarge] - pdftohtml <unfixed>
34  krb4          [etch] - pdftohtml <unfixed>
35  krb5          NOTE: has been replaced by poppler-utils
36  heimdal          - kdegraphics 4:4.2.2-1 (embed; bug #436164)
37            - texlive-base 3.0-12 (embed)
38  grip: (which pkg is the origin?)          - texlive-bin 2007-1 (embed)
39  libcdaudio          - koffice 1:2.0.0-1 (embed; bug #436163)
40  grip          - libextractor 0.5.12-1 (embed)
41  gnome-vfs (vfs2 as well?)          NOTE: libextractor is using its own pdf decoder now
42            - ipe <unfixed> (embed)
43  fudforum:          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
44  phpgroupware-fudforum          - ruby-gnome2 <unknown> (embed)
45  egroupware-fudforum (removed from egroupware after sarge)          - pdfedit <unfixed> (embed; bug #510794)
46            - swftools <removed> (embed; bug #551293)
47  cvs:          - xpdf 3.02-9 (fork)
48  gcvs (at least an additional script is included, check if there's more)  
49    pdksh (no longer developed since 1999)
50  pcre:          - mksh <unfixable> (fork)
51  all pythons          - posh <unfixable> (fork)
52  php4 (src included, but Debian package links dynamically)  
53  analog (src included, but Debian package links dynamically)  ppmd
54  libgoffice-1          - libcomplearn-mod-ppmd <unfixed> (fork)
55  vfu (removed linking against embedded copy in 4.06-4.1; #450754)          NOTE: discussion in #458152
56  tf5 (since 5.0beta7 the Debian package links dynamically)  
57  monotone (including this starting from 0.37)  libevent
58  glib (2.14 series for gregex support, only for udeb, regular packag links dynamic)          - transmission 1.71-1 (embed; bug #529372)
59  apache2 (since 2.0.53-4 uses 040_link_external_pcre patch)          - chromium-browser 5.0.375.29~r46008-1
60  exim4 (since 4.10-0.srh20.12 uses 36_pcre patch to use external pcre)  
61  yacas (<= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway)  lrmi
62  gtamsanalyzer.app (links dynamically since 0.42-5)          - read-edid 2.0.0-1 (embed; bug #495131)
63            - s3switch <unfixed> (embed)
64  tiff:          - xresprobe <unfixed> (embed)
65  wxpythongtk (check, which debian pkg this is in)          - zhcon <unfixed> (embed)
66  older kdegraphics/kpdf releases < 3.3 embedded a copy  
67    php-htmlpurifier
68  uudeview:          - mahara 1.2.5-1 (embed)
69  libconvert-uulib-perl          - knowledgeroot 0.9.9.5-5 (embed)
70            - moodle <unfixed> (embed)
71  sqlite: (not affected by security vulnerabilities so far)  
72  amarok  peercast
73  monotone          - gnome-peercast <removed> (embed)
74  iceweasel          [etch] - gnome-peercast <unfixed> (embed)
75    
76  util-linux/mount:  silc-toolkit
77  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb          - silc-client 1.1~beta6-1 (embed)
78    
79  webmin:  icclib
80  usermin (only in sarge)          - ghostscript <unfixed> (embed)
81            - argyll <unfixed> (embed)
82  sylpheed:  
83  sylpheed-claws  libusb
84            - argyll <unfixed> (embed)
85  phpsysinfo:  
86  egroupware  dietlibc
87  phpgroupware          - ccontrol 0.9.1+20071204-1 (static)
88            - mksh <unfixable> (static)
89  phpldapadmin:          NOTE: /bin/mksh-static only, and only on some arches (others use eglibc)
90  egroupware (removed from egroupware after sarge)  
91    libmikmod
92  chmlib:          - sdl-mixer1.2 <unfixed> (embed)
93  kchmviewer (ships the code but links dynamically)          TODO: report bug
94    
95  libavcodec/libavformat (source: ffmpeg):  libiax
96  mplayer (#395252)          - iaxmodem <unfixable> (embed; bug #548885)
97  xvidcap  
98  kino (links statically, does not include code)  spandsp
99  vlc (links statically, does not include code)          - iaxmodem <unfixable> (embed; bug #548885)
100  smilutils (links statically, does not include code)  
101  motion (links statically, does not include code)  python-paramiko
102  gst-ffmpeg          - fabric 0.9.0-2 (embed; bug #561398)
103  gstreamer0.10-ffmpeg  
104  xmovie  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
105            - dpkg 1.15.6 (static)
106            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
107            - rsync <unfixed> (embed)
108            - cherokee <unfixed> (embed)
109            NOTE: somehow derived code base
110            - mono <unfixed> (embed)
111            TODO: check mozilla
112            - Linux kernels <unfixed> (embed)
113            - pvpgn 1.7.8-2 (embed)
114            - mrtg 2.12.2-1 (embed)
115            - rpm <unknown> (embed)
116            NOTE: pinged anibal since when rpm was fixed
117            - tuxcmd-modules <unfixed> (embed)
118            - zsync <unfixed>
119            - tra <unfixed>
120            - sash <unfixed>
121            - nsis <unfixed>
122            - pyfits 1:2.3.1-1
123            - mseide-msegui <unfixed>
124            NOTE: mseide
125            - mirrordir <unfixed>
126            - poco <unfixed>
127            - klibc <unfixed>
128            - emboss <unfixed>
129            - ghostscript <unfixed>
130            - freeimage <unfixed>
131            - clamav <unfixed> (fork)
132            NOTE: from the changelog: "libclamav6 does indeed duplicate parts of the zlib code, but there is not way around that"
133            - tuxonice-userui <unfixed> (static)
134            - plt-scheme <unfixed>
135            - perl <unfixed>
136            - paraview <unfixed>
137            - velvet 0.7.56~nozlibcopy-1
138            - gcvs <unfixed>
139            - dump <unfixed>
140            - aide <unfixed> (static)
141            - dar <unfixed> (static)
142            - avfs <unfixed>
143            - fpc <unfixed>
144            - winff <unfixed>
145            NOTE: inherited from fpc, see #472304
146            - lazarus <unfixed>
147            NOTE: inherited from fpc, see #472304
148            - erlang <unfixed> (embed)
149            - gamera 3.2.3-1 (embed)
150            - python2.4 <unfixed> (embed; bug #553403)
151            - python2.5 <unfixed> (embed; bug #553403)
152            - texlive-bin <unknown> (embed)
153    
154    dulwich
155            - hg-git 0.1.0-1 (embed; bug #541996)
156    
157    libvigraimpex
158            - hugin <unfixed> (embed; bug #542259)
159            - enblend-enfuse <unfixed> (embed; bug #542258)
160            - gamera 3.2.3-1 (embed)
161    
162    libbz2
163            - dpkg 1.15.6 (static)
164            - amd64-libs <unfixed> (static)
165            NOTE: let's call it "static"
166            - dar <unfixed> (static)
167            - dump <unfixed> (static)
168            - unalz 0.64-1 (embed)
169            NOTE: has code, by the maint, to use the system version but links against the internal copy
170            - clamav <unfixed> (embed)
171            NOTE: libclamav/nsis/bzlib*
172            - pristine-tar <unfixable> (modified-embed)
173            NOTE: compression code only, not uncompression
174    
175    libyahoo2
176            - centerim <unfixed> (embed; bug #559783)
177    
178    libmsn
179            - centerim <unfixed> (embed; bug #559783)
180    
181    libgadu
182            - centerim <unfixed> (embed; bug #559783)
183            - pidgin <not-affected> (links dynamically since initial release; fixed in gaim)
184            - gaim 1:2.0.0+beta3-3 (embed; bug #360280)
185            - kdenetwork 4:3.3.2-5 (embed)
186            NOTE: from kdenetwork: kopete
187            - ekg 1:1.8~rc0-1 (embed)
188            - kadu 0.6.0.2-3 (embed; bug #504430)
189            - gadu <itp> (embed)
190    
191    xmlrpc (which package is the "origin" of this code?)
192            - drupal <unfixed> (embed)
193            - phpgroupware <unfixed> (embed)
194            - egroupware <unfixed> (embed)
195            - phpwiki <unfixed> (embed)
196            - php4 <removed> (embed)
197            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
198    
199    shtool (affects build-time only)
200            - mysql-ocaml <unfixed> (embed)
201            - php4 <removed> (embed)
202            - php5 <unfixed> (embed)
203    
204  mad MPEG decoding lib:  xulrunner
205  mad          - iceape <unfixed> (embed; bug #561749)
206  xine-lib          - iceweasel 2.0.0.19 (embed)
207            - icedove <unfixed> (embed; bug #561750)
208            - kompozer <unfixed> (embed; bug #532168)
209            - galeon 2.0.2-4 (embed)
210            - epiphany-browser 2.14.3-8 (embed)
211            - conkeror 0.9~git080629-2 (embed)
212            - kazehakase 0.4.2-1 (embed)
213    
214    xli
215            - xloadimage <unfixed> (embed)
216    
217    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
218            - openmotif <unfixed> (embed)
219    
220    libxpm
221            - lesstif2 <unfixed> (embed; bug #575750)
222    
223    kerberized apps with BSD origin
224            - krb4 <removed> (embed)
225            - krb5 <unfixed> (embed)
226            - heimdal <unfixed> (embed)
227    
228    grip (which pkg is the origin?)
229            - libcdaudio <unfixed>
230            - grip <unfixed>
231            - gnome-vfs <unfixed>
232            TODO: check vfs2 as well
233    
234    fudforum
235            [etch] - phpgroupware <unfixed> (embed)
236            NOTE: phpgroupware-fudforum
237            [sarge] - egroupware-fudforum <removed> (embed)
238    
239    libbsd
240            - rdate 1:1.2-3 (embed)
241            - atheme-services <unfixed>
242            - libbsd-arc4random-perl <not-affected> (modified-embed)
243            NOTE: code not used, it links dynamically against libbsd instead
244            - isakmpd <unfixed>
245            - bsdgames <unfixed> (embed)
246            - bsd-mailx <unfixed> (embed)
247            - netcat-openbsd <unfixed> (embed; bug #550611)
248            - openssh <unfixed> (embed)
249            - unworkable <unfixed> (embed)
250            - mksh <unfixed> (modified-embed)
251            NOTE: strlcpy(), only used in /bin/mksh-static on eglibc arches
252            NOTE: FIXME, we should only have one entry: - mksh <not-affected> (modified-embed)
253            NOTE: strlcpy() on dietlibc arches; {g,s}etmode(); both unused
254    
255    cvs
256            - gcvs <unfixed> (embed)
257            NOTE: see cvsunix/src in tarball
258    
259    pcre3
260            - php4 <removed> (embed)
261            - analog 2:5.23-0woody1 (embed)
262            - goffice <unfixed> (embed)
263            NOTE: libgoffice-*
264            - vfu 4.06-4.1 (embed; bug #450754)
265            - tf5 5.0beta7-1 (embed)
266            - monotone 0.43-1 (embed)
267            NOTE: this only affects versions >= 0.37
268            - glib2.0 2.15.2-1 (embed)
269            - apache2 2.0.53-4 (embed)
270            - exim4 4.10-0.srh20.12 (embed)
271            - yacas <unfixed> (embed)
272            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
273            - gtamsanalyzer.app 0.42-5 (embed)
274            - tin 980117-1 (embed)
275            - kazehakase 0.5.2-1
276            - webkit 1.0.1-1 (embed)
277            - qt4-x11 <unfixed> (embed)
278            NOTE: embedded via webkit copy
279            - erlang <unfixed> (embed)
280            - ssed <unfixed> (embed)
281            - ircd-hybrid <unfixed> (static)
282            - emboss <unfixd>
283            - cherokee <unfixed> (embed)
284            - oftc-hybrid 1.6.9.dfsg-1 (embed)
285            - ratbox-services <unfixed> (embed)
286            - squeak-vm <unfixed> (embed)
287            - tinymux <unfixed> (embed)
288    
289    tiff
290            - wxwindows2.4 2.2.1 (embed)
291            - gamera 3.2.3-1 (embed)
292            - freeimage <unfixed> (embed)
293            - libtk-img <unfixed> (embed)
294            NOTE: there are two copies, one under tiff/ other under libtiff/
295            - gdal <unfixed>
296    
297    uudeview
298            - libconvert-uulib-perl <unfixed> (embed)
299            - pan <unfixed> (embed)
300    
301    sqlite (not affected by security vulnerabilities so far)
302            - amarok <unfixed> (embed)
303            - monotone 0.43-1 (embed)
304            - iceweasel <unfixed> (embed)
305            - heimdal <unfixed> (embed; bug #559616)
306    
307    util-linux/mount
308            - loop-aes-utils <unfixed> (embed)
309            NOTE: contains code from util-linux' mount in the mount-aes-udeb
310    
311    sylpheed
312            - sylpheed-claws <unfixed> (fork)
313    
314    phpsysinfo
315            - egroupware <unfixed> (embed)
316            - phpgroupware <unfixed> (embed)
317    
318    phpldapadmin
319            [sarge] - egroupware <unfixed> (embed)
320            NOTE: removed from egroupware after sarge
321    
322    chmlib
323            - kchmviewer <unknown> (embed)
324    
325    ffmpeg (libavcodec/libavformat)
326            - mplayer 1.0~rc2-14 (embed; bug #395252)
327            - kino 1.0.0-1
328            - vlc <not-affected> (Links dynamically since initial release)
329            - smilutils 0.3.0-10
330            NOTE: smilutils likely fixed earlier, marking Etch's version as fixed
331            - motion 3.1.19-1
332            - gstreamer0.10-ffmpeg 0.10.3-2
333            - xmovie <removed> (static)
334            TODO: gimp-gap (potentially using ffmpeg code as well)
335            - avifile 1:0.7.48~20090503.ds-1 (embed; bug #538750)
336            - audacity 1.3.7-2 (embed; bug #512278)
337            - chromium-browser <unfixed> (fork)
338    
339    faad2
340            - mplayer 1.0~rc2-20 (embed)
341            - avifile <unfixed> (embed; bug #538750)
342            - ffmpeg-debian <removed> (embed)
343    
344    libmad (MPEG decoding lib)
345            - xine-lib <unfixed> (embed)
346            - avifile 1:0.7.48~20090503.ds-1 (embed) [./plugins/libmad/*]
347            TODO: check ocaml-mad, madplay, pymad, xmms-mad, xmms2
348    
 libdts:  
349  libdts  libdts
350  xine-lib          - xine-lib <unfixed> (embed)
351    
 flac:  
352  flac  flac
353  xine-lib          - xine-lib <unfixed> (embed)
354    
355  liba52:  liba52
356  a52dec          - a52dec <unfixed> (embed)
357  xine-lib          - xine-lib <unfixed> (embed)
358    
359    mpeg2dec (libmpeg2)
360            - xine-lib <unfixed> (embed)
361    
362    libmpeg3
363            - squeak-vm <unfixed> (embed)
364    
365    libntlm
366            - wget <unfixed> (fork; bug #550436)
367            - curl <unfixed> (fork; bug #550437)
368            - cntlm <unfixed> (fork; bug #550438)
369    
370    uw-imap
371            - pine <unfixed> (embed)
372            - alpine <unfixed> (embed)
373    
374    imagemagick
375            - graphicsmagick <unfixed> (fork)
376    
377    python-urlgrabber
378            - mercurial <unfixed> (embed; bug #531062)
379            - w3af <unfixed> (embed; bug #555372)
380            [experimental] - harvestman <unfixed> (embed; bug #555373)
381    
382    beautifulsoup
383            - python-mechanize <unfixed> (embed; bug #555349)
384            - zope2.11 <removed> (embed; bug #555350)
385            - twill <unknown> (embed)
386    
387    halibut
388            - nsis <unfixed> (fork)
389    
390    libghttp
391            - hotway <unfixed> (embed)
392    
393    libsndfile
394            - ardour 1:2.7.1-1 (embed)
395    
396    glibmm2.4
397            - ardour 1:2.7.1-1 (embed)
398    
399    libgnomecanvasmm2.6
400            - ardour 1:2.7.1-1 (embed)
401    
402    libsigc++-2.0
403            - ardour 1:2.7.1-1 (embed)
404    
405    soundtouch
406            - ardour 1:2.7.1-1 (embed)
407    
408    libmms
409            - xine-lib <unfixed> (embed)
410            - mimms <unfixed> (embed)
411    
412    fckeditor
413            - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
414            - moin 1.8.2-2 (embed; bug #452599)
415            - karrigell <removed> (embed; bug #452598)
416            - gforge 4.6.99+svn6225-1 (embed)
417            - request-tracker3.8 <unfixed> (embed)
418            - otrs2 <unfixed> (embed)
419    
420    ipatlas (not packaged in Debian)
421            - moodle <unfixed> (embed; bug #507185)
422    
423    libphp-phpmailer
424            - moodle <unfixed> (embed; bug #507185)
425            - mahara <unfixed> (embed)
426            - symfony <unfixed> (embed; bug #566778)
427            [etch] - phpgroupware <unfixed> (embed)
428            NOTE: phpgroupware-felamimail is only in etch
429            - egroupware <unfixed> (embed; bug #504283)
430            - glpi <unfixed>
431    
432    htmlArea (not packaged in Debian)
433            - moodle <unfixed> (embed)
434    
435    giflib
436            - wine <unfixed> (embed; bug #466181)
437    
438    bennu (not packaged in Debian, http://bennu.sourceforge.net)
439            - moodle <unfixed> (embed)
440    
441    smarty
442            - moodle 1.8.2-2 (embed; bug #471158)
443            - gallery2 2.2.5-2 (embed; bug #471160)
444            - mahara 0.9.2-2 (embed; bug #471201)
445            - gosa 2.4beta1-1 (embed; bug #471200)
446    
447    TinyMCE
448            - wordpress 2.5.1-3 (embed; bug #478257)
449            - moodle <unfixed> (embed; bug #507185)
450            - knowledgeroot <unfixed> (embed)
451            - joomla <itp> (bug #326398)
452            - mahara 1.2.6-1 (embed; #597752)
453    
454    scintilla (upstream provides static lib, rejected shared lib http://sf.net/support/tracker.php?aid=2488121)
455            - scite <unfixed> (embed)
456            - qscintilla <unfixed> (embed)
457            - qscintilla2 <unfixed> (embed)
458            - geany <unfixed> (fork)
459            - anjuta <unfixed> (embed)
460    
461    libphp-adodb
462            - moodle <unfixed> (embed; bug #507185)
463            NOTE: also AdoDB-XML Schema
464            - gallery2 <unfixed> (embed)
465            - phppgadmin <unfixed> (embed)
466            - egroupware <unfixed> (embed)
467            - phpwiki <unfixed> (embed)
468            - torrentflux 2.0beta1-2 (embed)
469            - ipplan <unfixed> (embed)
470            - typo3-src <unfixed> (embed)
471            - cacti <unknown> (embed)
472            [sarge] - cacti <unfixed> (embed)
473            NOTE: dependency exists, but internal version is used
474            - gforge 4.7~rc2-6 (embed)
475            - mahara <unfixed> (embed)
476    
477    gzip
478            - linux-2.6 <unfixed> (embed) [lib/inflate.c]
479            - klibc <unfixed> (embed)
480            NOTE: based on linux-kernel gzip code
481            - busybox <unfixed> (embed)
482            - pristine-tar <unfixed> (modified-embed)
483            NOTE: compression code only, not uncompression
484            - ncompress <unfixed> (old-version)
485    
486    neon
487            - cadaver 0.22.3+debian-1 (embed; bug #188381)
488            - gnome-vfs2 <unfixed> (embed; bug #395874)
489            [etch] - litmus <unfixed> (embed; #395875)
490            - litmus <removed> (embed; #395875)
491            [sarge] - screem <unfixed> (embed)
492            - sitecopy 1:0.16.0-1 (embed; bug #395876)
493            [etch] - tla <unfixed> (embed; bug #395877)
494            [sarge] - tla <unfixed> (embed; bug #395877)
495    
496    libmodplug
497            - gst-plugins-bad0.10 0.10.10.2-1 (embed)
498    
499    libvncserver
500            - vino <unfixed> (embed)
501    
502    putty
503            - filezilla <unfixed> (embed)
504    
505    tinyxml (not packaged in Debian; itp bug #531968)
506            - filezilla <unfixed>
507            - crystalspace <unfixed> (embed)
508            - libwfut <unfixed> (embed)
509            - rarian <unfixed> (embed)
510            - bulletml <unfixed> (embed)
511            - pokerth <unfixed> (embed)
512            - qutecom <unfixed> (embed)
513            - sofa-framework <unfixed> (embed)
514            - yate <unfixed> (embed)
515            - antigrav <unfixed> (embed)
516            - balder2d <unfixed> (embed)
517            - cal3d <unfixed> (embed)
518            - criticalmass <unfixed> (embed)
519            - ember <unfixed> (embed)
520            - epiphany <unfixed> (embed)
521            - gambit <unfixed> (embed)
522            - noiz2sa <unfixed> (embed)
523            - ogre <unfixed> (embed)
524            - opencity <unfixed> (embed)
525            - openmovieeditor <unfixed> (embed)
526            - pouetchess <unfixed> (embed)
527            - tecnoballz <unfixed> (embed)
528            - trigger-rally <unfixed> (embed)
529            - xmoto <unfixed> (embed)
530            - mapnik <unknown> (embed)
531            NOTE: uses a different XML parser by default
532            - rrootage 0.23a-6 <embed>
533            NOTE: links to libbulltetml
534            - boson <unknown> (embed)
535            NOTE: the embedded code is unused
536    
537    gv
538            - evince <unfixed> (embed)
539            NOTE: ps/ tree from gv 3.5.8
540            NOTE: evince-gtk is affected (a component of evince source package)
541    
542    libXbae
543            - paw <unfixed> (embed)
544    
545    libgtkhtml
546            - claws-mail-extra-plugins <unfixed> (fork)
547    
548    libXaw
549            - paw <unfixed> (embed)
550            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
551    
552    libgd2
553            - graphviz <unfixed> (embed)
554            NOTE: lib/gd seems to be 2.0.33
555            - wml 2.0.11ds2-1 (embed)
556            - libwmf <unfixed> (embed)
557            NOTE: derived from gd 1.6.3
558            - texlive-bin 2009-1 (embed)
559    
560    rar
561            - unrar-nonfree <unfixed> (embed)
562    
563    unrar-free (maybe this code is derived from the original rar, too?)
564            - clamav <unfixed> (embed)
565            NOTE: seems to be disabled in default config
566    
567    mplayer (DirectMedia Object loader)
568            - xine-lib <unfixed> (embed)
569            NOTE: src/libw32dll/
570            - vlc <unfixed> (embed)
571            NOTE: modules/codec/dmo/
572            - mplayer 1.0~rc2-20 (embed)
573    
574    libwpd (WordPerfect converter)
575            - openoffice.org <unfixed> (embed)
576    
577    fsplib (http://sourceforge.net/projects/fsp/)
578            - gftp <unfixed> (embed)
579            NOTE: lib/fsplib version 0.3
580    
581    sprng
582            - tree-puzzle <unfixed> (embed)
583    
584    librpcsecgss
585            - krb5 <unfixed> (embed)
586    
587    jasper
588            - ghostscript 8.64~dfsg-2 (embed)
589    
590    libiris
591            - psi <unfixed> (embed)
592            - kdenetwork <unfixed> (embed)
593            NOTE: kopete embeds libiris but links dynamically to libidn
594            - kdegames <unfixed> (embed)
595            NOTE: ksirk/kde4
596    
597    libidn
598            - monotone 0.43-1 (embed)
599            - psi <unfixed> (embed)
600            NOTE: psi embeds libiris which embeds libidn
601            - kdegames <unfixed> (embed)
602            NOTE: kdegames/kde4 embeds libiris which embeds libidn
603    
604    lua5.1
605            - monotone 0.43-1 (embed)
606            - nmap 5.00-1 (embed; bug #527997)
607            [lenny] - nmap <unfixed> (embed; bug #527997)
608            - ocropus <unfixed> (embed)
609            - enigma <unfixed> (embed)
610            NOTE: requires lua built with C++
611            - freeciv <unfixed> (embed)
612            - spring <unfixed> (embed)
613    
614    libbotan
615            - monotone 0.43-1 (embed)
616    
617    NetXX
618            - monotone 0.43-1 (embed)
619    
620    libgc
621            - mono <unfixed> (embed)
622    
623    lzma
624            - p7zip <unfixed> (embed)
625            - xz-utils <unfixed> (fork)
626    
627    lzo
628            - grub2 <unfixed> (embed)
629    
630    yassl
631            - mysql-dfsg-5.0 <unfixed> (embed)
632            - mysql-5.1 <unfixed> (embed)
633    
634    pax code
635            - tar <unfixed> (embed)
636            - cpio <unfixed> (embed)
637    
638    t1lib
639            - tetex-bin 2.0.2-1 (embed)
640            - texlive-bin <unknown> (embed)
641    
642    guichan
643            - boswars <unfixed> (embed)
644            NOTE: maintainer notified us, working on it
645    
646    tolua
647            - boswars <unfixed> (embed)
648            NOTE: maintainer notified us, working on it
649            NOTE: actually tolua++
650            - ocropus <unfixed> (embed)
651            NOTE: actually tolua++
652            - freeciv <unfixed> (embed)
653            NOTE: actually tolua++
654            - enigma <unfixed> (embed)
655    
656    asio-dev
657            - luxrender <removed> (embed)
658    
 libmpeg2:  
 mpeg2dec  
659  xine-lib  xine-lib
660            - vlc <unfixed> (embed)
661            NOTE: only parts included in modules/access/rtsp
662    
663  curl:  netpbm
664  wget (code for NTLM authentication)          - tcl8.3 <unfixed> (embed)
665            - tcl8.4 <unfixed> (embed)
666            - tcl8.5 <unfixed> (embed)
667            NOTE: generic/tkImgGIF.c
668    
669    tk8.5
670            - tk8.0 <removed> (old-version)
671            - tk8.3 <unfixed> (old-version)
672            - tk8.4 <unfixed> (old-version)
673            - perl-tk <unfixable> (fork)
674    
675    samba
676            - mc 2:4.6.2~git20080311-1 (embed)
677            NOTE: maintainer is aware of this, currently searching a solution
678    
679    plib1.8.4c2
680            - boson <unfixed> (fork)
681            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
682    
683    fribidi
684            - quesoglc 0.7.2-2 (embed)
685    
686    glew
687            - quesoglc <unfixed> (embed; bug #489341)
688            NOTE: waiting on GLEW_MX version of glew (see bug #474488)
689            - trigger 0.5.2.1-2 (embed)
690            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
691            - trigger-rally 0.5.2.1-2 (embed)
692            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
693            - chromium-browser 5.0.375.70~r48679-2
694    
695    minorGems (pabs contacted upstream about shared lib, he considers minorGems an 'ever-evolving collection of reusable code fragments' for his own use)
696            - transcend <unfixed> (embed)
697            - cultivation <unfixed> (embed)
698            - passage <unfixed> (embed)
699            - gravitation <unfixed> (embed)
700    
701  TODO evaluate:  tar
702  gimp-gap (potentially using ffmpeg code as well)          - libarchive <unfixed> (embed)
703            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
704    
705  uw-imap:  cpio
706  pine          - libarchive <unfixed> (embed)
707  alpine          NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
708    
709  imagemagick:  kde4libs
710  graphicsmagick          - kdelibs <unfixable> (old-version)
711    
712  halibut:  webkit
713  nsis          - qt4-x11 <unfixed> (embed; bug #479851)
714            [etch] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
715            - kde4libs <unfixable> (fork)
716            NOTE: kde4lib's khtml and webkit were forked from khtml (this tracking, which seems
717            NOTE: reversed genesis-wise, is used because of so much other stuff in kde4libs)
718            - chromium-browser <unfixed> (fork)
719    
720    ftgl
721            - blender 2.46+dfsg-1 (embed)
722    
723    wv
724            - abiword <unfixed>
725    
726    qemu
727            - kvm <removed> (embed; bug #543159)
728            - qemu-kvm <unfixed> (embed; bug #560853)
729            NOTE: kvm superceded by qemu-kvm, which is just user interface (no modules)
730            - xen-3 3.4.2-2 (embed; bug #560856)
731            - xen-unstable <unfixed> (embed; bug #560856)
732    
733    vgabios
734            - kvm <removed> (embed; bug #489442)
735            - qemu-kvm <unfixed> (embed)
736    
737    bochs
738            - kvm <removed> (embed; bug #489442)
739            - qemu-kvm <unfixed> (embed)
740    
741    speex
742            - vorbis-tools <unfixed> (embed)
743            NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
744            - gst-plugins-good0.10 <unfixed> (embed)
745            - xine-lib <unfixed> (embed)
746            - libfishsound <unfixed> (embed)
747            - libannodex <removed> (embed)
748            - vlc <unfixed> (embed)
749            - xmms-speex <unfixed> (embed)
750            - libsdl-sound1.2 <unfixed> (embed)
751            - sweep <unfixed> (embed)
752    
753    libreadline
754            - magic <itp> (old-version)
755    
756    opcode
757            - ode <unfixed> (embed)
758            NOTE: opcode is not a package in debian, it is just embedded
759            NOTE: http://www.codercorner.com/Opcode.htm
760    
761    gimpact
762            - ode <unfixed> (embed)
763            NOTE: gimpact is not a package in debian, it is just embedded
764            NOTE: http://gimpact.sf.net
765    
766    mochikit
767            - mahara <unfixed> (embed)
768            NOTE: they require extra patches, still unmerged upstream
769            - ntop <unfixed> (embed)
770            - coherence 0.6.2-1 (embed)
771            - paste <unfixed> (embed)
772            - turbogears <unfixed> (embed)
773            - plone3 <removed> (embed)
774            - xulrunner <unfixed> (embed)
775            - libjifty-plugin-chart-perl <unfixed> (embed)
776            - sabnzbdplus <unfixed> (embed)
777            - tgmochikit <unfixed> (embed)
778    
779    prototypejs
780            - netbeans-ide 6.0.1+dfsg-2 (embed)
781            - auth2db 0.2.5-2+dfsg-1 (embed; bug #555218)
782            - webcit <unfixed> (embed; bug #555219)
783            - asterisk 1:1.6.2.0~rc3-1 (embed)
784            - libjson-ruby 1.1.4-1 (embed; bug #555224)
785            - lucene2 2.9.1+ds1-2 (embed; bug #555226)
786            - horde3 <unfixed> (embed)
787            - knowledgeroot 0.9.8.5-4 (embed; bug #555230)
788            - mediatomb 0.12.0~svn2018-5 (embed; bug #555233)
789            - mt-daapd 0.9~r1696.dfsg-6lenny2 (embed)
790            - ebug-http <unfixed> (embed; bug #555236)
791            - libaws 2.7-1 (embed; bug #555222)
792            - phpgedview <removed> (embed)
793            - poker-network 1.7.6-1 (embed; bug #555238)
794            - rails 2.1.0-6 (embed)
795            - wordpress 2.5.0-2 (embed; bug #555243)
796            - zope <not-affected> (the prototypejs embed is not in any of the obvious zope packages, e.g. zope2.9, zope2.10, zope2.11, and zope3)
797            TODO: search through all of the other zope packages
798            - ampache 3.4.1-2 (embed)
799            - exaile 0.2.14+debian-2.1 (embed; bug #555245)
800            - hobix 0.5~svn20070319-4 (embed; bug #555247)
801            - zabbix 1.6.6-4 (embed; bug #555250)
802            - chora2 2.1.1+debian0-1 (embed; bug #555253)
803            - gollem 1.1.1+debian0-1 (embed; bug # 555254)
804            - jscropperui 1.2.1-1 (embed; bug #555257)
805            - scriptaculous <not-affected> (uses system prototype.js since initial upload; bug #555260)
806            - ingo1 1.2.3+debian0-1 (embed; bug #555261)
807            - kronolith2 2.3.3+debian0-1 (embed; bug #555262)
808            - activeldap 1.2.1-1 (embed)
809            - libv8 <not-affected> (contains a google-specific implementation of prototype.js)
810            - mantis 1.1.2+dfsg-1 (embed; bug #555265)
811            - otrs2 2.3.4-6 (embed; bug #555267)
812            - webcalendar 1.2~b1-2 (embed; bug #555269)
813            - redmine 0.9.0~svn2907-1 (embed; bug #555270)
814            - jifty 0.90519-1 (embed; bug #555271)
815            - jquery 1.4-1 (embed; bug #555272)
816            - passenger 2.2.5debian1-1 (embed; bug #555273)
817            - plone3 <removed> (embed; bug #555275)
818            - wesnoth <not-affected> (prototype.js not included in any of the binary packages; bug #555277)
819            - libhtml-prototype-perl 1.48-3 (embed; bug #538920)
820            - xulrunner <unfixed> (embed)
821            NOTE: included in iceweasel/xulrunner unit tests directory, so may not be security-relevant
822            - jclicmoodle <unfixed> (embed)
823            - git-cola <unfixed> (embed)
824    
825    gdb
826            - insight <unfixed> (embed)
827    
828    e2fsprogs
829            - ldiskfsprogs <unfixable> (fork)
830    
831    quazip (not packaged in Debian)
832            - qcake <unfixed> (embed)
833            NOTE: starting with upstream version 0.6.4
834    
835    exo
836            - pcmanfm <unfixed> (embed; bug #499677)
837            NOTE: slightly modified source code
838    
839    java
840            - openjdk-6 <unfixed>
841            - sun-java5 <unfixed>
842            - sun-java6 <unfixed>
843    
844    libphp-snoopy
845            - ampache 3.4.1-2 (embed; bug #504169)
846            - gforge 4.6.99+svn6094-2 (embed)
847            - mahara 1.0.5-2 (embed; bug #504170)
848            - pixelpost 1.7.1-5 (embed; bug #504171)
849            - mediamate 0.9.3.6-5 (embed; bug #504172)
850            - opendb <removed> (embed; bug #504173)
851            [etch] - opendb <unfixed> (embed; bug #504173)
852            - wordpress 2.5.1-9 (embed; bug #443948)
853            - moodle <unfixed> (embed; bug #507185)
854            [etch] - phpgroupware <unfixed> (embed)
855            NOTE: phpgroupware-felamimail
856            - magpierss 0.72-3 (embed; bug #431089)
857    
858    jquery
859            - zekr <unfixed> (embed)
860            - wordpress <unknown> (embed)
861            - yocto-reader <unfixed> (embed)
862            - textpattern <unfixed> (embed)
863            - genshi 0.5.1-1 (embed)
864            NOTE: compressed file under examples/ dir
865            - prewikka <unfixed> (embed)
866            - libramaze-ruby <unfixed> (embed)
867            - drupal6 <unfixed> (embed)
868            - b2evolution <unfixed> (embed)
869            - wesnoth <unfixed> (embed)
870    
871    tablesorter (jquery plugin, not packaged yet)
872            - wesnoth <unfixed> (embed)
873    
874    kses
875            - wordpress <unfixed> (embed; bug #504242)
876            NOTE: their copy has all methods renamed to wp_<foo>
877            NOTE: kses isn't in Debian, RFP: #504240
878            - moodle <unfixed> (embed; bug #507185)
879            - egroupware <unfixed> (embed)
880    
881    magpierss
882            - wordpress <unfixed> (embed; bug #504242)
883            - moodle <unfixed>
884    
885    php-gettext
886            - wordpress 2.8.4-1 (embed; bug #504242)
887            - docbookwiki <unfixed> (embed)
888            - knowledgeroot 0.9.9.5-1
889            NOTE: non-free
890    
891    libphp-ixr (name may change, it is the Incutio XML-RPC)
892            - wordpress <unfixed> (embed; bug #504242)
893            NOTE: libphp-ixr isn't in Debian, RFP: #504236
894            - dokuwiki <unfixed> (embed)
895            - textpattern <unfixed> (embed)
896    
897    libphp-cas
898            - glpi <unfixed> (embed)
899            - moodle <unfixed> (embed; bug #505984)
900    
901    scriptaculous (prototype.js is among the embeds in the following)
902            - glpi <unfixed> (embed)
903            - libaws <unfixed> (embed; bug #555222)
904            - op-panel <unfixed> (embed)
905            - symfony <unfixed> (embed)
906            NOTE: maintainer says there are extra incompatible changes required
907            - pixelpost 1.7.1-6 (embed)
908            - webhelpers <unfixed> (embed)
909            - qwik <removed> (embed; bug #555241)
910            - smokeping <unfixed> (embed)
911            - turba2 <unfixed> (embed)
912            - typo3-src 4.2.3-1 (embed)
913            - request-tracker3.6 <unfixed> (embed)
914            - request-tracker3.8 <unfixed> (embed)
915            - rt-extension-emailcompletion <not-affected> (prototype.js not included in the binary package)
916            - wordpress 2.5.0-2 (embed)
917            - libhtml-prototype-perl 1.48-3 (embed)
918    
919    libmarkdown-php
920            - moodle <unfixed> (embed; bug #507185)
921            - pixelpost 1.7.1-6 (embed)
922    
923    php-openid
924            - wordpress-openid 3.3.2-1 (embed)
925    
926    geshi
927            - dokuwiki 0.0.20080505-3.1 (embed)
928            - pgfouine 1.0-1.1 (embed)
929            - websvn 2.1.0-1 (embed)
930    
931    webcalendar
932            - gforge 4.7~rc2-6 (embed; bug #504758)
933    
934    libical
935            - kdepim <unknown> (fork)
936            NOTE: fixed at some point during 4.0
937            - kdepimlibs 4.2.0-1 (fork)
938            - claws-mail-extra-plugins <unfixed> (fork)
939    
940    harfbuzz
941            - qt4-x11 <unfixed> (embed)
942            - pango1.0 <unfixed> (embed)
943            - fontmatrix <unfixed> (embed)
944    
945    libzip
946            - php5 <unfixable> (modified-embed)
947            - odt2txt <unfixed> (embed; bug #523808)
948    
949    json.php (not packaged; should be replaced with php's built-in functions)
950            - moodle <unfixed>
951            - yui <unfixed>
952            - gallery2 <unfixed>
953            - dokuwiki <unfixed>
954            - typo3-src <unfixed>
955    
956    php-fpdf
957            - tcpdf <itp> (fork)
958            - moodle <unfixed>
959            - phpwiki <unfixed>
960            - egroupware <unfixed>
961            - ldap-account-manager <unfixed> (fork)
962    
963    tcpdf (itp: #495985)
964            - moodle <unfixed>
965            - phpmyadmin <unfixed>
966    
967  libghttp:  typo3
968  hotway          - moodle <unfixed>
969    
970  libsndfile:  spreadsheet_writeexcel (PHP port of libspreadsheet-writeexcel-perl; itp: #487557)
971  ardour          - moodle <unfixed>
972            - gosa <unfixed>
973    
974    php-ole (itp: #487558)
975            - moodle <unfixed>
976    
977    pieforms (http://www.catalyst.net.nz)
978            - mahara <unfixed>
979    
980    savant2 (http://phpsavant.com)
981            - egroupware <unfixed>
982    
983    rssparser (http://nwow.org)
984            - egroupware <unfixed>
985            - phpgroupware <unfixed>
986    
987    lcms
988            - openjdk-6 <unfixed> (fork)
989            - gimp 2.4.0~rc2-2
990    
991    libphp-phplayersmenu
992            - diogenes <unfixed>
993            - phpldapadmin <unfixed>
994    
995    libphp-pclzip
996            - docvert <unfixed>
997            - moodle <unfixed>
998            - egroupware <unfixed>
999    
1000    libphp-simplepie
1001            - dokuwiki <unfixed>
1002            - wordpress <unfixed>
1003    
1004    libphp-jpgraph
1005            - egroupware <unfixed>
1006    
1007    php-simpletest
1008            - moodle <unfixed>
1009    
1010    libpng
1011            - iceweasel <not-affected> (uses xulrunner)
1012            - icedove 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1, 2.0.0.19-1 (embed)
1013            - iceape 1.0.13~pre080614i-0etch1 (embed)
1014            - xulrunner 1.9.0.13-1 (embed)
1015            [lenny] - xulrunner 1.9.0.11-0lenny1
1016            [etch] - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
1017            - gamera 3.2.3-1 (embed)
1018            - freeimage <unfixed> (embed)
1019            - tuxonice-userui <unfixed> (static)
1020    
1021    irssi
1022            - silc-client <unfixed> (embed)
1023            NOTE: Seems to be a pre-0.8.12 version that is used in irssi-plugin-silc
1024    
1025    extc
1026            - mtasc <unfixed> (embed)
1027            - haxe <unfixed> (embed)
1028    
1029    swflib
1030            - mtasc <unfixed> (embed)
1031            - haxe <unfixed> (embed)
1032    
1033    libitext-java
1034            - bouncycastle 2.1.4-1 (embed)
1035    
1036    python-ply
1037            - pyke <unfixed> (embed; bug #555363)
1038            - pywbem 0.7.0-4 (embed; bug #555364)
1039            - sepolgen <unfixed> (embed; bug #555365)
1040            - zope-textindexng3 <unknown> (embed)
1041            - iceweasel <not-affected> (uses xulrunner)
1042            - xulrunner <unknown> (embed)
1043            - wireshark <not-affected> (python-ply modules are not installed into binary packages; see #554613)
1044    
1045    libdumbnet (libdnet upstream)
1046            - nmap <unfixed> (fork)
1047    
1048    gcc-4.4
1049            - gcc-mingw32 <unfixed> (embed)
1050    
1051    camlimages
1052            - advi <unfixed> (static; bug #550441)
1053    
1054    memcached
1055            - memcachedb <unfixed> (embed)
1056    
1057    yajl
1058            - argyll <unfixed> (embed; bug #544223)
1059            NOTE: reference, confirmed by build logs: http://lists.debian.org/debian-mentors/2009/08/msg00062.html
1060    
1061    nusoap
1062            - gforge 4.8.2-1 (embed)
1063            - ampache <unfixed> (embed)
1064            - poker-network <unfixed> (embed)
1065            - moodle <unfixed> (embed)
1066            NOTE: code is not used when running under php5 and soap is enabled
1067            - phpwiki <unfixed> (embed)
1068            - gallery2 <unfixed> (embed)
1069            - typo3-src <unfixed> (embed)
1070            - phpgacl 3.3.7-7 (embed)
1071            - mantis 1.1.8+dfsg-1 (embed)
1072    
1073    libept
1074            - adept <unfixed> (embed; bug #540649)
1075    
1076    libvorbis
1077            - iceweasel <not-affected> (uses xulrunner)
1078            - xulrunner <unfixed> (embed; bug #540959)
1079            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1080            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1081            - iceape <unfixed> (embed)
1082            [etch] - iceape <not-affected> (introduced in 2.0)
1083            [lenny] - iceape <not-affected> (introduced in 2.0)
1084    
1085    cairo
1086            - iceweasel <not-affected> (uses xulrunner)
1087            - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
1088    
1089    liboggz
1090            - iceweasel <not-affected> (uses xulrunner)
1091            - xulrunner <unfixed> (embed; bug #540959)
1092            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1093            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1094            - iceape <unfixed> (embed)
1095            [etch] - iceape <not-affected> (introduced in 2.0)
1096            [lenny] - iceape <not-affected> (introduced in 2.0)
1097    
1098    liboggplay
1099            - iceweasel <not-affected> (uses xulrunner)
1100            - xulrunner <unfixed> (embed; bug #540959)
1101            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1102            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1103            - iceape <unfixed> (embed)
1104            [etch] - iceape <not-affected> (introduced in 2.0)
1105            [lenny] - iceape <not-affected> (introduced in 2.0)
1106    
1107    php-net-dnsbl
1108            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1109    
1110    php-onyx-rss
1111            - serendipity <unfixed> (embed; bug #541740; wontfix: only one script, own package is overkill, appears not to be duplicated in Debian)
1112    
1113    php-text-wiki
1114            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1115    
1116    php-xml-rpc
1117            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1118    
1119    polarssl (does not have a shared library)
1120            - pdkim <itp> (embed; bug #543150)
1121            - xyssl <unfixed> (old-version)
1122    
1123    pidgin (libpurple)
1124            - gaim <removed> (old-version)
1125            - qutecom 2.2~rc3.hg396~dfsg1-6 (embed; bug #559785)
1126    
1127    icu
1128            - webkit 1.0.1-1 (embed; bug #547214)
1129            - texlive-bin <unfixed> (fork)
1130            NOTE: texlive upstream working with icu upstream to merge their changes
1131            - chromium-browser 5.0.375.29~r46008-3
1132    
1133    cyrus-imapd-2.2
1134            - kolab-cyrus-imapd <unfixed> (fork)
1135            - dovecot 1:1.2.1-1 (embed) [/dovecot-sieve/src/libsieve/*]
1136    
1137    python-cxx-dev
1138            - freecad 0.9.2646.3-1 (embed; bug #547936)
1139    
1140    zipios++
1141            - freecad 0.9.2646.3-1 (embed; bug #547941)
1142            - enigma 0.92.3-3 (embed)
1143            NOTE: likely fixed earlier, marking etch's version as fixed
1144    
1145    linux-2.6
1146            - kvm <removed> (embed; bug #549973) [./kernel/*]
1147            - linux-kbuild-2.6 <unfixed> (embed; bug #550379) [./kbuild/*]
1148            - kernel-source-2.6.8 <removed> (old-version)
1149            - kernel-source-2.4.27 <removed> (old-version)
1150            - kernel-source-2.4.24 <removed> (old-version)
1151            - kernel-source-2.2.25 <removed> (old-version)
1152            - kernel-source-2.2.20 <removed> (old-version)
1153    
1154    libfdt (not yet packaged separately for debian; http://www.jdl.com/software/)
1155            - kvm <removed> (embed) [./libfdt/*]
1156            - qemu-kvm <unfixed> (embed) [./libfdt/*]
1157    
1158    qweb (not packaged)
1159            - ajaxterm <unfixed>
1160    
1161    opensaml2
1162            - opensaml <removed> (old-version)
1163    
1164    shibboleth-sp2
1165            - shibboleth-sp <removed> (old-version)
1166    
1167    tuxonice-userui
1168            - suspend2-userui <removed> (old-version)
1169    
1170    expat
1171            - w3c-libwww <removed> (embed; bug #551941)
1172            [etch] - w3c-libwww <unfixed> (embed; bug #551941) [./modules/expat/*]
1173            - python-xml <unfixed> (embed; bug #551940) [./extensions/expat/*]
1174            - python2.5 <unfixable> (embed; bug #553403) [./Modules/expat/*]
1175            - python2.4 <unfixable> (embed; bug #553403)
1176            - python2.7 2.7-6 (embed)
1177            - python-4suite <unfixed> (embed; bug #516935)
1178            - wxwindows2.4 <removed> (embed)
1179            - wxwidgets2.6 2.6.3.2.2-4 (embed)
1180            - wxwidgets2.8 2.8.10.1-2 (embed)
1181            - celementtree 1.0.5-8 (embed)
1182            NOTE: Maybe that was fixed even earlier
1183            - audacity 1.3.2-1 (embed)
1184            - matanza <unfixed> (embed)
1185            - tdom 0.8.3~20080525-1 (embed)
1186            - udunits 2.1.8-4 (embed)
1187            - apr-util 1.2 (embed)
1188            - ayttm <unfxed> (embed; bug #561006)
1189            - cableswig <unfixed> (embed)
1190            - cadaver <unfixed> (embed)
1191            - cmake 2.6.0-6 (embed)
1192            - coin3 <unfixed> (embed)
1193            - gdcm 2.0.14-2 (embed)
1194            - ghostscript 8.71~dfsg-2 (embed)
1195            - grmonitor <removed> (embed)
1196            - iceape <unfixed> (embed)
1197            - insighttoolkit 3.16.0-1 (embed)
1198            NOTE: insighttoolkit might've been fixed earlier
1199            - libparagui1.1 1.0.2-1 (embed)
1200            - paraview 3.6.2-1 (embed)
1201            - poco 1.3.6p1-1 (embed)
1202            - simgear <unfixed> (embed)
1203            - sitecopy 1:0.16.0-1
1204            - smart <unfixed> (embed)
1205            NOTE: smart embeds celementree, and it includes expat
1206            - swish-e <not-affected> (Linked against libxml, which is used instead)
1207            - tla 1.3.5+dfsg-15 (embed)
1208            - vtk 4.1.20030227-1 (embed)
1209            - wbxml2 <not-affected> (expat code is only used on Mac OS X, see #560941)
1210            - xmlrpc-c <unfixed> (embed)
1211            - iceweasel <unfixed> (embed)
1212            - kompozer <unfixed> (embed)
1213            - vxl 1.13.0-2 (embed)
1214            - xulrunner <unfixed> (embed)
1215            - apache2 2.2 (embed)
1216            - texlive-bin <not-affected> (Embedded code not compiled in)
1217            - vnc4 <unfixed> (embed)
1218            - xotcl 1.6.6-1 (embed)
1219            - chromium-browser 5.0.375.29~r46008-3
1220    
1221    xerces-c
1222            - xerces-c2 <unfixed> (old-version)
1223            - xerces27 <removed> (old-version)
1224    
1225    md5 (RSA's version; not the gnu version provided by coreutils)
1226            - w3c-libwww <removed> (embed; bug #551942)
1227            [etch] - w3c-libwww <unfixed> (embed; bug #551942) [./modules/md5/*]
1228    
1229    libparagui1.1
1230            - asc <unfixable> (fork)
1231    
1232    enet
1233            - sauerbraten <unfixed> (embed; #497194)
1234    
1235    eglibc
1236            - glibc <removed> (old-version)
1237            - mksh <unfixable> (static)
1238              NOTE: /bin/mksh-static only, and only on some arches (others use dietlibc)
1239    
1240    galib
1241            - gamera 3.2.3-1 (embed)
1242    
1243    configobj
1244            - bzr 2.1.0~rc2-1 (embed; bug #555336)
1245            - elisa <unfixed> (embed; bug #555337)
1246            - gaupol <unfixed> (embed; bug #555338)
1247            - ipython <unfixed> (embed; bug #555339)
1248            - pida <unfixed> (embed; bug #555340)
1249            - psychopy <unfixed> (embed; bug #555341)
1250            - rest2web <unfixed> (embed; bug #555342)
1251            - auth2db <unknown> (embed)
1252            - dynagen <unknown> (embed)
1253            - iceweasel <unknown> (embed)
1254            - sabnzbdplus <unknown> (embed)
1255            - xulrunner <unknown> (embed)
1256            - nipy <not-affected> (part of an example [/examples/neurospin/neurospy/configobj.py], which is not installed into binary packages)
1257    
1258    python-clientform
1259            - bibus <unfixed> (embed; bug #555332)
1260            - zope2.10 <unfixed> (embed; bug #555333)
1261            - zope2.11 <removed> (embed; bug #555334)
1262            - python-mechanize <unknown> (embed)
1263            - twill <unknown> (embed)
1264    
1265    python-mechanize
1266            - zope2.10 <unfixed> (embed; bug #555337)
1267            - zope2.11 <removed> (embed; bug #555338)
1268            - twill <unknown> (embed; bug #555339)
1269    
1270    pexpect
1271            - duplicity 0.6.06-1 (embed; bug #555361)
1272            - hplip <unfixed> (embed; bug #555362)
1273            - smart <unfixed> (embed; bug #555363)
1274    
1275    pyparsing
1276            - bauble <unfixed> (embed; bug #555366)
1277            - boa-constructor 0.6.1-8 (embed; bug #555367)
1278            - calibre <unfixed> (embed; bug #555368)
1279            - matplotlib <unfixed> (embed; bug #531024)
1280            - zhpy 1.7.3.1-1 (embed; bug #555370)
1281            - polybori <unknown> (embed)
1282            - python-whoosh <unknown> (embed)
1283            - twill <unknown> (embed)
1284            - zope-textindexng3 <unknown> (embed)
1285    
1286    python-pysqlite2
1287            - python2.4 <unfixed> (embed; bug #553403)
1288            - python2.5 <unfixed> (embed; bug #553403)
1289    
1290    celementtree
1291            - python2.5 <unfixed> (embed)
1292            - smart <unfixed> (embed)
1293    
1294    elementtree
1295            - python2.5 <unfixed> (embed)
1296            - python2.6 <unfixed> (embed)
1297            - bzr 2.1.0~rc2-1 (embed; bug #555343)
1298            - gedit 2.28.2-1 (embed; bug #555344)
1299            - smart <unfixed> (embed)
1300            - solfege <unfixed> (embed; bug #555345)
1301            - w3af <unfixed> (embed; bug #555346)
1302            - python-qt4 <unknown> (embed)
1303            - sphinx <unknown> (embed)
1304            - python-nltk <itp> (embed)
1305    
1306    python2.5
1307            - python2.4 <unfixed> (old-version)
1308            - jython <unfixed> (embed)
1309            NOTE: embeds many stdlib modules
1310            - python-django <unfixed> (embed; bug #555419)
1311            NOTE: embeds stdlib modules: doctest, decimal
1312            - gamera 3.2.3-1 (embed)
1313            NOTE: embeds stdlib modules: ConfigParser, optparse, sets, textwrap
1314            - boa-constructor <unfixed> (embed; bug #555426)
1315            NOTE: embeds stdlib modules: ConfigParser, tarfile, zipfile, xmlrpclib
1316            - nicotine <unfixed> (embed; bug #555427)
1317            NOTE: embeds stdlib modules: ConfigParser
1318            - museek+ <unfixed> (embed; bug #555428)
1319            NOTE: embeds stdlib modules: ConfigParser
1320            - vegastrike-data <removed> (embed)
1321            NOTE: embeds many stdlib modules
1322            - codespeak-lib 1.1.1-1 (embed; bug #555420)
1323            NOTE: embeds stdlib modules: doctest, optparse, subprocess, textwrap
1324            - config-manager <unfixed> (embed; bug #555423)
1325            NOTE: embeds stdlib modules: optparse
1326            - jhbuild 2.28.0-1 (embed; bug #555421)
1327            NOTE: embeds stdlib modules: optparse, subprocess
1328            - smart <unfixed> (embed; bug #555432)
1329            NOTE: embeds stdlib modules: optparse
1330            - pyprotocols 1.0a.svn20070625-5 (embed; bug #555433)
1331            NOTE: embeds stdlib modules: doctest
1332            - ruledispatch 0.5a.svn20080510-4 (embed; bug #555434)
1333            NOTE: embeds stdlib modules: doctest
1334            - distribute <unfixed> (embed)
1335            NOTE: embeds stdlib modules: doctest
1336            - python-setuptools <unfixed> (embed; bug #555435)
1337            NOTE: embeds stdlib modules: doctest
1338            - zope.testing <unfixed> (embed; bug #555436)
1339            NOTE: embeds stdlib modules: doctest
1340            - translate-toolkit <unfixed> (embed; bug #555422)
1341            NOTE: embeds stdlib modules: textwrap, contextlib
1342            - libtpclient-py <unfixed> (embed; bug #555424)
1343            NOTE: embeds stdlib modules: subprocess
1344            - grass <unfixed> (embed; bug #555425)
1345            NOTE: embeds stdlib modules: subprocess
1346            - coherence <unfixed> (embed; bug #555429)
1347            NOTE: embeds stdlib modules: uuid
1348            - python-django-extensions 0.4.2pre+git200911182050-1 (embed; bug #555430)
1349            NOTE: embeds stdlib modules: uuid
1350            - setroubleshoot <removed> (embed; bug #555431)
1351            NOTE: embeds stdlib modules: uuid
1352            - linkchecker <unfixed> (embed; bug #555414)
1353            NOTE: embeds msgfmt.py script
1354            - imdbpy <unfixed> (embed)
1355            NOTE: embeds msgfmt.py script
1356            - kiwi <unfixed> (embed)
1357            NOTE: embeds msgfmt.py script
1358            - moin <unfixed> (embed)
1359            NOTE: embeds msgfmt.py script, stdlib modules: cgitb, difflib, tarfile
1360            - plone3 <removed> (embed)
1361            NOTE: embeds msgfmt.py script
1362            - roundup <unfixed> (embed)
1363            NOTE: embeds msgfmt.py script, stdlib modules: cgitb
1364            - rednotebook <unfixed> (embed; bug #555415)
1365            NOTE: embeds msgfmt.py script
1366            - turbogears <unfixed> (embed)
1367            NOTE: embeds msgfmt.py script
1368            - elisa <unfixed> (embed)
1369            NOTE: embeds msgfmt.py script, stdlib modules: uuid
1370            - calibre <unfixed> (embed)
1371            NOTE: embeds msgfmt.py script, stdlib modules: zipfile
1372            - mailman 1:2.1.13-1 (embed; #555416)
1373            NOTE: embeds msgfmt.py script
1374            - python-docutils <unknown> (embed)
1375            NOTE: embeds stdlib modules: optparse, textwrap
1376            - python-imaging <unknown> (embed)
1377            NOTE: embeds stdlib modules: doctest
1378            - python-mechanize <unknown> (embed)
1379            NOTE: embeds stdlib modules: doctest
1380            - twill <unknown> (embed)
1381            NOTE: embeds stdlib modules: subprocess
1382            - zeroc-ice <unknown> (embed)
1383            NOTE: embeds stdlib modules: subprocess
1384            - wxwidgets2.8 <unknown> (embed)
1385            NOTE: embeds stdlib modules: subprocess
1386            - cycle <unknown> (embed)
1387            NOTE: embeds msgfmt.py script
1388            - deluge <unknown> (embed)
1389            NOTE: embeds msgfmt.py script
1390            - opendict <unknown> (embed)
1391            NOTE: embeds msgfmt.py script
1392            - openerp-client <unknown> (embed)
1393            NOTE: embeds msgfmt.py script
1394            - rapidsvn <unknown> (embed)
1395            NOTE: embeds msgfmt.py script
1396            - wammu <unknown> (embed)
1397            NOTE: embeds msgfmt.py script
1398            - gaphor <unknown> (embed)
1399            NOTE: embeds msgfmt.py script
1400            - pida <unknown> (embed)
1401            NOTE: embeds msgfmt.py script
1402            - python-formencode <unknown> (embed)
1403            NOTE: embeds msgfmt.py script
1404            - duplicity <unfixed> (embed)
1405            NOTE: embeds stdlib module: urlparse, tarfile
1406            - pygopherd <unfixed> (embed)
1407            NOTE: embeds stdlib module: zipfile
1408    
1409    argparse
1410            - twill <unfixed> (embed; bug #555347)
1411            - ipython <unfixed> (embed; bug #555348)
1412    
1413    coherence
1414            - elisa <unfixed> (embed; bug #555335)
1415    
1416    simpletal
1417            - plastex <unfixed> (embed; bug #555371)
1418    
1419    flickrpc (not packaged in Debian, http://burtonini.com/bzr/flickrpc/)
1420            - postr <unfixed> (embed)
1421            - elisa <unfixed> (embed)
1422    
1423    simplegeneric (not packaged in Debian, http://pypi.python.org/pypi/simplegeneric)
1424            - apertium-tolk <unfixed> (embed)
1425            - ipython <unfixed> (embed)
1426            - virtaal <unfixed> (embed)
1427    
1428    distribute
1429            - setuptools <removed> (old-version)
1430    
1431    rails
1432            - jruby1.2 <removed> (embed) [./bench/rails/*]
1433            NOTE: jruby is in non-free, it probably includes rails too
1434            - libgettext-ruby <unfixed> (embed) [./samples/rails/*]
1435            - libopenid-ruby <unfixed> (embed) [./examples/rails_openid/*]
1436            - thin <unfixed> (embed) [./spec/rails_app/*]
1437            NOTE: this is a subdirectory of examples, which in general is a non-issue, but may
1438            NOTE: be dangerous if developers are naively basing their code off of the examples
1439            NOTE: prototype.js is among the example files
1440    
1441    lucene2 (prototype.js is among the embeds in the following)
1442            - lucene <unfixed> (old-version)
1443            - pylucene <unfixed> (embed)
1444            - libpdfbox-java <unfixed> (embed)
1445            - libfontbox-java <unfixed> (embed)
1446            - libjempbox-java <unfixed> (embed)
1447            - solr <unfixed> (embed)
1448    
1449    unicode-data
1450            - syslinux <unfixed> (embed)
1451            - camomile <unfixed> (embed)
1452            - fribidi <unfixed> (embed)
1453            - m17n-db <unfixed> (embed)
1454            - sbcl <unfixed> (embed)
1455            - heimdal <unfixed> (embed)
1456            - icu <unfixed> (embed)
1457            - icu4j <unfixed> (embed)
1458            - krb5 <unfixed> (embed)
1459            - moodle <unfixed> (embed)
1460            - openldap <unfixed> (embed)
1461            - pike7.6 <unfixed> (embed)
1462            - samba <unfixed> (embed)
1463            - samba4 <unfixed> (embed)
1464            - cmucl <unfixed> (embed)
1465            - typo3-src <unfixed> (embed)
1466            - mauve <unfixed> (embed)
1467            - texlive-bin <unfixed> (embed)
1468            - ypsilon <unfixed> (embed)
1469            - jeuclid <unfixed> (embed)
1470            - charmap.app <unfixed> (embed)
1471            - clisp <unfixed> (embed)
1472            - gnulib <unfixed> (embed)
1473            - opensrs-client <unfixed> (embed)
1474            - saxonb <unfixed> (embed)
1475            - rails <unfixed> (embed)
1476    
1477    feedparser
1478            - rawdog <unfixed> (embed; bug #383422)
1479            - miro <unfixed> (embed; bug #555351)
1480            - calibre <unfixed> (embed; bug #555352)
1481            - freevo <unfixed> (embed; bug #555353)
1482            - pida <unfixed> (embed; bug #555354)
1483            - planet-venus <unfixed> (embed; bug #555355)
1484            - plone3 <removed> (embed; bug #555356)
1485            - exaile 0.2.14+debian-1 (embed)
1486            - screenlets 0.1.2-3 (embed)
1487            NOTE: included twice
1488    
1489    agg:
1490            - matplotlib <unfixed> (embed: bug #377271)
1491            - contextfree <unfixed> (embed)
1492            NOTE: since 2.2-1 it links statically to system libagg, but still uses the embedded copy
1493            - exactimage <unfixed> (embed)
1494            - python-enable <unfixed> (embed)
1495            - mapnik 0.5.1-3 (embed)
1496            NOTE: links statically to agg, but shared library is not available (bug #377271)
1497    
1498    vtk
1499            - paraview <unfixable> (embed; bug #495426)
1500    
1501    txt2tags
1502            - rednotebook <unfixed> (embed)
1503    
1504    htmltextview (not packaged in Debian, http://www.gnome.org/~gjc/htmltextview.py)
1505            - gajim <unfixed> (embed)
1506            - emesene <unfixed> (embed)
1507            - convirt <unfixed> (embed)
1508            - pida <unfixed> (embed)
1509            - rednotebook <unfixed> (embed)
1510    
1511    horde3 (prototype.js is among the embeds in the following)
1512            - mnemo2 <unfixed> (embed)
1513            - nag2 <unfixed> (embed)
1514            - wordpress <unfixed> (embed)
1515            NOTE: Text_Diff (wp-includes/Text/Diff*)
1516    
1517    cimg
1518            - gmic <unfixed> (embed)
1519    
1520    mootools
1521            - kdenetwork <unfixed> (embed)
1522            - gallery <unfixed> (embed)
1523            - jspwiki <unfixed> (embed)
1524            - vdr-plugin-live <unfixed> (embed)
1525            - perl-doc-html <unfixed> (embed)
1526    
1527  glibmm2.4:  openldap
1528  ardour          - openldap2.3 <removed> (old-version)
1529    
1530  libgnomecanvasmm2.6:  grub2
1531  ardour          - grub <unfixed> (old-version)
1532    
1533  libsigc++-2.0:  gnupginterface
1534  ardour          - duplicity <unfixed> (embed)
1535    
1536  soundtouch:  python-dateutil
1537  ardour          - awn-extras-applets <unfixed> (embed)
1538            - matplotlib <unknown> (embed)
1539    
1540    cups
1541            - cupsys <removed> (old-version)
1542    
1543    yui
1544            - bcfg2 <not-affected> (present in source but not included in any binary files)
1545            - serendipity 1.5.3-1 (embed; bug #557746)
1546            - moodle 1.8.2.dfsg-5 (embed)
1547            - jifty 0.91117-1 (embed; bug #557748)
1548            - webgui 7.7.26-1 (embed)
1549            - loggerhead 1.17-1 (embed)
1550            - otrs2 2.4.7+dfsg1-1 (embed; bug #592146)
1551    
1552    quake3 (vanilla source not packaged in debian)
1553            - openarena <unfixable> (fork)
1554    
1555    quake2 (vanilla source not packaged in debian)
1556            - alien-arena <unfixable> (fork)
1557            - warsow <unfixable> (fork)
1558    
1559    libtheora
1560            - iceweasel <not-affected> (uses xulrunner)
1561            - xulrunner <unfixed> (embed; bug #540959)
1562            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1563            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1564            - iceape <unfixed> (embed; bug #559276)
1565            [etch] - iceape <not-affected> (introduced in iceape 2.0)
1566            [lenny] - iceape <not-affected> (introduced in iceape 2.0)
1567    
1568    dtoa
1569            - bfilter <unfixed> (embed)
1570            - cacao <removed> (embed)
1571            - cdrdao <unfixed> (embed)
1572            - classpath <unfixed> (embed)
1573            - freej <unfixed> (embed)
1574            - iceape <unfixed> (embed)
1575            - iceweasel <unfixed> (embed)
1576            - jscoverage <unfixed> (embed)
1577            - kde4libs <unfixed> (embed)
1578            - kdelibs <unfixed> (embed)
1579            - kompozer <unfixed> (embed)
1580            - libv8 <unfixed> (embed)
1581            - mono <unfixed> (embed)
1582            - newlib <unfixed> (embed)
1583            - nspr <unfixed> (embed)
1584            - php5 <unfixed> (embed)
1585            - polyml <unfixed> (embed)
1586            - qt4-x11 <unfixed> (embed)
1587            - rhino <unfixed> (embed)
1588            NOTE: code translated to Java
1589            - ruby1.8 <unfixed> (embed)
1590            - ruby1.9 <unfixed> (embed)
1591            - ruby1.9.1 <unfixed> (embed)
1592            - sdd <unfixed> (embed)
1593            - sfind <unfixed> (embed)
1594            - star <unfixed> (embed)
1595            - tinymux <unfixed> (embed)
1596            - virtualbox-ose <unfixed> (embed)
1597            - webkit <unfixed> (embed)
1598            - xulrunner <unfixed> (embed)
1599    
1600    ipc (not packaged in Debian; see http://mozdev.org/pipermail/enigmail/2009-November/011678.html)
1601            - firegpg <unfixed> (embed)
1602            - enigmail <unfixed> (embed)
1603    
1604    ptmalloc (not packaged in Debian)
1605            - crystalspace <unfixed> (embed)
1606            - qt4-x11 <unfixed> (embed)
1607    
1608    svgalib
1609            - usplash <unfixed> (embed)
1610    
1611    bogl
1612            - usplash <unfixed> (embed)
1613    
1614    taglist
1615            - usplash <unfixed> (embed)
1616    
1617    portaudio
1618            - audacity <unfixed> (embed; bug #323711)
1619    
1620    nyquist
1621            - audacity <unfixed> (embed)
1622            NOTE: embeds a forked nyquist with support for a shared library
1623    
1624  libmms:  vamp-plugin-sdk
1625  xine-lib          - audacity <unfixed> (embed)
 mimms  
1626    
1627  FCKeditor: (packaged as fckeditor)  wordpress
1628  knowledgeroot          - libwordpress-xmlrpc-perl <removed> (embed) [./xmlrpc.php]
1629  moin (452599)          - wordpress-mu <removed> (fork)
 karrigell (452598)  
 gforge-plugins-extra (fixed since 4.6.99+svn6225-1)  
1630    
1631    php5
1632            - php4 <removed> (old-version)
1633    
1634    classpath
1635            - libgnucrypto-java <removed> (embed; bug #559788)
1636    
1637  Moodle contains lots of things:  libtool
1638  AdoDB          - apr <unfixed> (static; bug #489625)
1639  AdoDB-XML Schema          NOTE: ships copy of libtool in libapr1-dev; was 'embed' before 1.3.2-3
1640  ipatlas          - arts <unfixed> (embed)
1641  PHPMailer          - bochs 2.4.2-1 (embed; bug #560884)
1642  Smarty          - camserv <unfixed> (embed)
1643  htmlArea          - collectd 4.8.2-1 (embed)
1644  TinyMCE          - courier-authlib 0.58-4 (embed)
1645  bennu          NOTE: The etch version of courier-authlib was the earliest version checked, might be fixed earlier
1646            - cvsnt 2.5.04.3236-1.2 (embed)
1647            - dico <not-affected> (Uses the system copy of ltdl)
1648            - freeradius 0.1+20010527-1 (embed)
1649            NOTE: Earliest reference I could find from the changelog is from 27 May 2001
1650            - ggobi 2.1.9~20091212-1 (embed)
1651            - glame 2.0.1-4 (embed)
1652            NOTE: The etch version of glame was the earliest version checked, might be fixed earlier
1653            - gnash 0.8.7-2 (embed)
1654            - gnu-smalltalk <unfixed> (embed; bug #566777)
1655            - google-gadgets 0.10.5-0.3 (embed)
1656            NOTE: 0.10.5-0.3 was the earliest version checked, was fixed earlier
1657            - graphicsmagick 1.3.5-6 (embed)
1658            - graphviz 2.8-3 (embed)
1659            NOTE: The etch version of graphviz was the earliest version checked, might be fixed earlier
1660            - guile-1.6 1.6.8-7 (embed)
1661            - hamlib 1.2.11-1 (embed)
1662            - hercules 3.06-1.2 (embed)
1663            - jags 1.0.4-3 (embed; bug #560864)
1664            - kdelibs <unfixed> (embed)
1665            - libannodex <removed> (embed)
1666            - libextractor 0.5.23+dfsg-4 (embed)
1667            - libmcrypt <not-affected> (libtool source present but not included in any of the binary packages)
1668            - libtunepimp 0.5.3-7.3 (embed)
1669            - mp4h 1.3.1-4.1 (embed)
1670            - naim <removed> (embed)
1671            - parser-mysql <unfixed> (embed)
1672            - pinball 0.3.1-11 (embed)
1673            - redland <unfixed> (embed)
1674            - siproxd <unfixed> (embed)
1675            - ski <unfixed> (embed)
1676            - synfig 0.62.00-1 (embed)
1677            - unixodbc 2.2.4-5 (embed)
1678            - xmlsec1 <not-affected> (Doesn't enable dynamic loading of crypto modules)
1679            - clamav 0.95+dfsg-1 (embed)
1680            - imagemagick 6:6.2.3.1-1 (embed)
1681            - hypre 2.4.0b-5 (embed)
1682            - lam <unfixed> (embed)
1683            - openmpi <unfixable> (embed; bug #559386)
1684            - parser <unfixed> (embed)
1685            - pdsh 2.18-5 (embed; bug #560892)
1686            - sbnc 1.2-8 (embed)
1687            - sdcc <unfixed> (embed)
1688            - wml <not-affected> (The embedded ltdl isn't used, instead mp4h is used, see 559841)
1689            - proftpd-dfsg <unfixed> (embed; bug #561748)
1690            - babel 1.4.0.dfsg-5 (embed)
1691            - libprelude 0.9.14-2 (embed)
1692            - heartbeat 2.1.4-7 (embed)
1693            NOTE: From Squeeze onwards the system copy of ltdl is used, use the current version from Squeeze,
1694            NOTE: might've been fixed earlier
1695            - gcc-* <unknown> (embed)
1696    
1697    ocamlgsl
1698            - orpie 1.5.1-7.1 (embed; bug #550058)
1699    
1700    xdotool
1701            - keynav <unfixed> (embed; bug #560103)
1702    
1703    bulletphysics (not packaged; http://www.bulletphysics.org/)
1704            - supertuxkart <unfixed> (embed)
1705            - blender <unfixed> (embed)
1706    
1707  TinyMCE:  ghostscript
1708  wordpress          - gs-gpl <removed> (old-version)
 moodle  
 knowledgeroot  
 joomla (ITP)  
   
 scintilla:  
 scite  
 qscintilla  
 qscintilla2  
 geany  
   
 libphp-adodb:  
 gallery2  
 phppgadmin  
 egroupware  
 phpwiki  
 ipplan  
 typo3  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
1709    
1710  gzip:  icedove
1711  linux-kernel (lib/inflate.c)          - thunderbird <removed> (old-version)
 klibc (based on linux-kernel gzip code)  
 busybox  
1712    
1713  neon:  sizzlejs (not packaged in Debian, http://sizzlejs.com/)
1714  cadaver (all, but being worked on: #188381)          - jquery <unfixed> (embed)
 gnome-vfs2 (#395874)  
 litmus (#395875)  
 screem (sarge only)  
 sitecopy (#395876)  
 tla (etch/sid only: #395877)  
1715    
1716  libmodplug:  sed
1717  gst-plugins-bad0.10          - ssed <unfixed> (fork)
1718    
1719  libvncserver:  phpatomlib (http://code.google.com/p/phpatomlib)
1720  vino          - wordpress <unfixed> (embed)
1721    
1722    Services_JSON (http://pear.php.net/package/Services_JSON)
1723            - wordpress <unfixed> (embed)
1724    
1725    phpass (http://www.openwall.com/phpass/)
1726            - gallery2 <unfixed> (embed)
1727            - wordpress <unfixed> (embed)
1728            - typo3-src <unfixed> (modified-embed)
1729            NOTE: file refers to drupal, maybe there's a copy somewhere there
1730            NOTE: a copyright owner search didn't match anything
1731            - libauthen-passphrase-perl <unfixable> (fork)
1732            NOTE: perl implementation of phpass
1733    
1734    squirrelmail
1735            - wordpress <unfixed> (embed)
1736            NOTE: class-pop3.php
1737    
1738    ezSQL (http://www.woyano.com/jv/ezsql)
1739            - wordpress <unfixable> (fork)
1740            NOTE: wp-db.php
1741    
1742    Diff.php (Clay Loveless' version/killersoft.com)
1743            - php-versioncontrol-svn <unfixed>
1744    
1745    libm (provided by libc)
1746            - spring <unfixed> (embed)
1747            NOTE: embedded by embedded copy of streflop
1748            - aide <unfixed> (static)
1749            - busybox <unfixed> (static)
1750            - mindi-busybox <unfixed> (static)
1751            - qemu <unfixed> (static)
1752            NOTE: qemu-user-static
1753            - tuxonice-userui <unfixed> (static)
1754            - zsh <unfixed> (static)
1755            NOTE: zsh-static
1756            - tripwire <unfixed>
1757    
1758    streflop
1759            - spring <unfixed> (embed)
1760    
1761  putty:  minizip
1762  filezilla          - spring <unfixed> (embed)
1763    
1764  tinyxml (not packaged in Debian):  oscpack
1765  filezilla          - spring <unfixed> (embed)
1766    
1767  gv:  hpiutil2
1768  evince (ps/ tree from gv 3.5.8)          - spring <unfixed> (embed)
 evince-gtk (not packaged in Debian)  
1769    
1770  libXbae:  p7zip
1771  libpawlib2-lesstif package (from Cernlib)          - spring <unfixed> (embed)
1772    
1773  libXaw:  pythonqt (doesn't seem to be python-qtN, unknown source)
1774  libpawlib2-lesstif package (from Cernlib)          - fontmatrix <unfixed> (embed)
1775            - elmerfem <unfixed> (embed)
1776    
1777  (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  iepngfix (not packaged in Debian; http://www.twinhelix.com/css/iepngfix/)
1778            - docvert <unfixed> (embed)
1779            - jifty <unfixed> (embed)
1780            - kdenetwork <unfixed> (embed)
1781            - mediatomb <unfixed> (embed)
1782            - plastex <unfixed> (embed)
1783            - plone3 <removed> (embed)
1784            - python-chaco <unfixed> (embed)
1785            - python-docutils <unfixed> (embed)
1786            - s5 <unfixed> (embed)
1787            - zope2.10 <unfixed> (embed)
1788            - zope2.11 <removed> (embed)
1789            - cython <not-affcted> (embed)
1790            NOTE: part of documentation, which is not installed into the binary package
1791    
1792  libgd2:  python-docutils
1793  graphviz (lib/gd seems to be 2.0.33)          - zope2.10 <unfixed> (embed)
1794            - zope2.11 <removed> (embed)
1795    
1796  rar:  tesseract
1797  unrar-nonfree          - ocropus <unfixed> (static)
1798    
1799  unrar-free: (maybe this code is derived from the original rar, too?)  antlr
1800  clamav (seems to be disabled in default config)          - kdevelop <unfixed> (embed)
1801    
1802  mplayer (DirectMedia Object loader):  libxerces2
1803  xine-lib (src/libw32dll/)          - openjdk-6 <unfixed> (embed)
 vlc (modules/codec/dmo/)  
1804    
1805  libwpd (WordPerfect converter):  kfreebsd-8
1806  openoffice.org          - kfreebsd-7 <unfixed> (old-version)
1807            - kfreebsd-6 <removed> (old-version)
1808    
1809  fsplib (http://sourceforge.net/projects/fsp/):  ruby1.9.1
1810  gftp (lib/fsplib version 0.3)          - ruby1.9 <unfixed> (old-version)
1811            - ruby1.8 <unfixed> (old-version)
1812    
1813  librpcsecgss:  maildrop
1814  krb5          - courier <unfixed> (embed) [./maildrop]
1815    
1816  jasper:  glee
1817  ghostscript          - warzone2100 <not-affected> (embed)
 gs-gpl  
1818    
1819  libidn:  phing
1820  monotone          - symfony <unfixed> (embed)
1821    
1822  liblua:  pake
1823  monotone          - symfony <unfixed> (embed)
1824    
1825  libbotan:  propel
1826  montone          - symfony <unfixed> (embed)
1827    
1828  NetXX:  creole
1829  monotone          - symfony <unfixed> (embed)
1830    
1831  libgc:  hfsutils
1832  mono          - cdrkit <unfixed> (embed; bug #570187)
1833            NOTE: embeds hfsutils code in genisoimage
1834    
1835  lzma:  cdrkit
1836  p7zip          - grub2 <unfixed> (embed; bug #570156)
1837            NOTE: genisoimage imported into grub-mkisofs
1838    
1839  lzo:  kdebase-workspace
1840  grub2          - kdebase <unfixed> (old-version)
1841    
1842  pax code:  file
1843  tar          - php5 <unfixable> (modified-embed)
1844  cpio          [lenny] - php5 <not-affected>
1845    
1846    cdb
1847            - php5 <unfixed> (embed)
1848    
1849    libmbfl (itp: #570708)
1850            - php5 <unfixed> (embed)
1851            NOTE: PHP is actually the current upstream, ITP is of that code
1852    
1853    libonig
1854            - php5 5.3.2-1 (embed)
1855    
1856    xmlrpc-epi
1857            - php5 <unfixed> (embed)
1858    
1859    swt-gtk
1860            - eclipse <unfixed> (embed; bug #538808)
1861    
1862    txt2html
1863            - wml 2.0.11ds2-1 (embed)
1864    
1865    ca-certificates
1866            - nss <not-affected> (certificates are in source, but not included in any of the binary packages)
1867    
1868    openexr
1869            - freeimage <unfixed> (embed)
1870    
1871    libmng
1872            - freeimage <unfixed> (embed)
1873    
1874    openjpeg
1875            - freeimage <unfixed> (embed)
1876    
1877    libjpeg6b
1878            - freeimage <unfixed> (embed)
1879    
1880    libjpeg (don't know what exact version)
1881            - dcmtk <unfixed>
1882            - gdcm <unfixed>
1883            - insighttoolkit <unfixed>
1884            - openarena <unfixed> (bug #495966)
1885            - outguess <unfixed>
1886            - squeak-vm <unfixed> (embed)
1887            - tremulous <unfixed>
1888            - tuxonice-userui <unfixed> (static)
1889            - fpc <unfixed> (static)
1890            - lazarus <unfixed> (static)
1891            NOTE: inherited from fpc, see #472304
1892            - mseide-msegui <unfixed> (static)
1893            NOTE: inherited from fpc, see #472304
1894            - easymp3gain <unfixed> (static)
1895            NOTE: inherited from fpc, see #472304
1896            - winff <unfixed> (static)
1897            NOTE: inherited from fpc, see #472304
1898            - texlive-bin <not-affected> (included in upstream source as dependency of libgd2, but not built or included in any of the binary packages)
1899    
1900    
1901    lxr
1902            - lxr-cvs <unfixed> (embed)
1903    
1904    libfile-copy-recursive-perl
1905            - r-base <unfixed> (embed; bug #577427)
1906            - r-base-core-ra <unfixed> (embed; bug #577429)
1907    
1908    delimmatch
1909            - r-base <unfixed> (embed; bug #577433)
1910            - r-base-core-ra <unfixed> (embed; bug #577434)
1911    
1912    libsmf (ITP: #572558)
1913            - denemo <unfixed> (embed)
1914            NOTE: http://lists.debian.org/debian-mentors/2010/04/msg00269.html
1915    
1916    libselinux
1917            - dpkg 1.15.6 (static)
1918    
1919    xinha (ITP: #479708)
1920            - horde3 <unfixed>
1921            - serendipity <unfixed>
1922            - openacs <unfixed>
1923            - dotlrn <unfixed>
1924    
1925    dvipng
1926            - texlive-bin <not-affected> (code present in source but not included in the binary packages)
1927    
1928    dvipdfmx
1929            - texlive-bin <unfixed> (embed)
1930            NOTE: this is intentionally part of the package now, and the separate dvipdfmx package has been removed from sid/squeeze
1931    
1932    lcdf-typetools
1933            - texlive-bin 2009-1 (embed)
1934    
1935    tex4ht
1936            - texlive-bin 2009-1 (embed)
1937    
1938    freetype
1939            - texlive-bin 2009-1 (embed)
1940    
1941    freetype2
1942            - texlive-bin 2009-1 (embed)
1943    
1944    silgraphite
1945            - texlive-bin <unfixed> (embed)
1946    
1947    unzip
1948            - texlive-bin 2009-1 (embed)
1949    
1950    jbig2dec
1951            - ghostscript 8.71~dfsg2-1 (embed)
1952    
1953    libxml2
1954            - chromium-browser 5.0.375.29~r46008-1
1955    
1956    protobuf
1957            - chromium-browser 5.0.375.70~r48679-2
1958    
1959    libv8
1960            - chromium-browser 5.0.375.38~r46659-1
1961    
1962    nspr
1963            - chromium-browser 5.0.375.29~r46008-3
1964    
1965    yasm
1966            - chromium-browser 5.0.375.29~r46008-2
1967    
1968    libxslt
1969            - chromium-browser 5.0.375.29~r46008-1
1970    
1971    miniupnpc (not packaged in Debian; ITP bug #444392)
1972            - warzone2100 <unfixed> (embed)
1973    
1974    iniparser (not packaged in Debian; RFP bug #582657)
1975            - warzone2100 <unfixed> (modified-embed)
1976    
1977    pyglet
1978            - sympy <unfixed> (embed; bug #459716)
1979    
1980  t1lib:  mpmath
1981  tetex-bin (links to system t1lib since 2.0.2)          - sympy <unfixed> (embed; bug #541746)
 texlive-bin (links to system t1lib)  
1982    

Legend:
Removed from v.7695  
changed lines
  Added in v.15413

  ViewVC Help
Powered by ViewVC 1.1.5