/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 7700 by jmm-guest, Sun Dec 23 10:58:57 2007 UTC revision 13833 by jmm-guest, Sat Jan 16 11:46:47 2010 UTC
# Line 1  Line 1 
1  Embedded code copies  Embedded code copies
2  ====================  ====================
3    
4  This file collects cases, where a source package embeds code from  This file collects source packages that embed code from other projects.
5  other projects which is considered bad for fixing security flaws  This is considered bad for fixing security flaws because the fix needs
6  because the fix needs to be applied in multiple source packages.  to be applied in multiple source packages.
7    
8  Format:  Format:
9  <srcpkg> (<optional comment about srcpkg>)  <srcpkg> (<optional comment about srcpkg>)
10          - <embedding srcpkg> <status> (<sort>; bug #<number>)          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11          NOTE: optional comments about the linkage of the embedding srcpkg          NOTE: optional comments about the linkage of the embedding srcpkg
12    
13  status: version number fixing the embedded copy, <unfixed>, <removed> or <unknown> if the version number can not be determined  status: version number fixing the embedded copy, <unfixed>, <removed>,
14  sort: static/dynamic          <itp>, <not-affected>, <unknown> if the version number can not
15            be determined, or <unfixable> for unavoidable cases (e.g., forks
16            that add real value)
17    sort: static (linking statically against a lib)
18          embed (embeds a copy of the library into another source package)
19          modified-embed (embeds a code copy that differs from upstream code)
20          fork (a full-blown fork of another source package)
21          old-version (an older version of essentially the same code)
22    
23    The srcpkg might be some string to identify the code if there is no
24    specific source package.
25    
26    Everything up to the next line is ignored.
27    ---BEGIN
28  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29          - gpdf <removed>          NOTE: Fixed packages link to poppler library unless otherwise noted
         [sarge] - gpdf <unfixed>  
         NOTE: has been replaced by evince in etch  
30          - pdftohtml <unknown>          - pdftohtml <unknown>
31          [sarge] - pdftohtml <unfixed>          [sarge] - pdftohtml <unfixed>
32          [etch] - pdftohtml <unfixed>          [etch] - pdftohtml <unfixed>
33          NOTE: has been replaced by poppler-utils          NOTE: has been replaced by poppler-utils
34          - kdegraphics <unfixed> (static; bug #436164)          - kdegraphics 4:4.2.2-1 (embed; bug #436164)
35          NOTE: the kpdf replacement in KDE 4 is using poppler          - texlive-base 3.0-12 (embed)
36          - tetex-bin 3.0-12 (dynamic)          - texlive-bin 2007-1 (embed)
         NOTE: links to poppler  
         - texlive-bin <unknown> (dynamic)  
         NOTE: links to poppler  
         - koffice <unfixed> (static; bug #436163)  
         - libextractor 0.5.12-1 (static)  
         NOTE: libextractor is using its own pdf decoder  
         - libextractor 0.5.12-1 (dynamic)  
37          NOTE: links to poppler          NOTE: links to poppler
38          - pdfkit.framework 0.8-4 (dynamic)          - koffice <unfixed> (embed; bug #436163)
39          NOTE: links to poppler          - libextractor 0.5.12-1 (embed)
40          - ipe <unfixed> (static)          NOTE: libextractor is using its own pdf decoder now
41            - ipe <unfixed> (embed)
42          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
43          - ruby-gnome2 <unknown> (dynamic)          - ruby-gnome2 <unknown> (embed)
44          NOTE: copy only present in source but links to poppler          NOTE: copy only present in source but links to poppler
45            - pdfedit <unfixed> (embed; bug #510794)
46            - swftools <unfixed> (embed; bug #551293)
47            - poppler <unfixable> (fork)
48    
49    ppmd
50            - libcomplearn-mod-ppmd <unfixed> (fork)
51            NOTE: discussion in #458152
52    
53    libevent
54            - transmission 1.71-1 (embed; bug #529372)
55    
56    lrmi
57            - read-edid 2.0.0-1 (embed; bug #495131)
58            - s3switch <unfixed> (embed)
59            - xresprobe <unfixed> (embed)
60            - zhcon <unfixed> (embed)
61    
62    peercast
63            - gnome-peercast <removed> (embed)
64            [etch] - gnome-peercast <unfixed> (embed)
65    
66    silc-toolkit
67            - silc-client 1.1~beta6-1 (embed)
68    
69    icclib
70            - ghostscript <unfixed> (embed)
71            - argyll <unfixed> (embed)
72    
73    dietlibc
74            - ccontrol 0.9.1+20071204-1 (static)
75    
76    libmikmod
77            - sdl-mixer1.2 <unfixed> (embed)
78            TODO: report bug
79    
80    libiax
81            - iaxmodem <unfixable> (embed; bug #548885)
82    
83    spandsp
84            - iaxmodem <unfixable> (embed; bug #548885)
85    
86    python-paramiko
87            - fabric 0.9.0-2 (embed; bug #561398)
88    
89    zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
90            - dpkg <unfixed> (static)
91            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
92            - rsync <unfixed> (embed)
93            - cherokee <unfixed> (embed)
94            NOTE: somehow derived code base
95            - mono <unfixed> (embed)
96            TODO: check mozilla
97            - Linux kernels <unfixed> (embed)
98            - pvpgn 1.7.8-2 (embed)
99            - mrtg 2.12.2-1 (embed)
100            - rpm <unknown> (embed)
101            NOTE: pinged anibal since when rpm was fixed
102            - tuxcmd-modules <unfixed> (embed)
103            - zsync <unfixed>
104            - tra <unfixed>
105            - sash <unfixed>
106            - nsis <unfixed>
107            - mseide-msegui <unfixed>
108            NOTE: mseide
109            - mirrordir <unfixed>
110            - poco <unfixed>
111            - klibc <unfixed>
112            - ghostscript <unfixed>
113            - freeimage <unfixed>
114            - clamav <unfixed> (fork)
115            NOTE: from the changelog: "libclamav6 does indeed duplicate parts of the zlib code, but there is not way around that"
116            - tuxonice-userui <unfixed>
117            - plt-scheme <unfixed>
118            - perl <unfixed>
119            - paraview <unfixed>
120            - gcvs <unfixed>
121            - dump <unfixed>
122            - aide <unfixed> (static)
123            - dar <unfixed> (static)
124            - avfs <unfixed>
125            - fpc <unfixed>
126            - winff <unfixed>
127            NOTE: inherited from fpc, see #472304
128            - lazarus <unfixed>
129            NOTE: inherited from fpc, see #472304
130            - erlang <unfixed> (embed)
131            - gamera 3.2.3-1 (embed)
132            - python2.4 <unfixed> (embed; bug #553403)
133            - python2.5 <unfixed> (embed; bug #553403)
134    
135    dulwich
136            - hg-git 0.1.0-1 (embed; bug #541996)
137    
138    libvigraimpex
139            - hugin <unfixed> (embed; bug #542259)
140            - enblend-enfuse <unfixed> (embed; bug #542258)
141            - gamera 3.2.3-1 (embed)
142    
143    libbz2
144            - dpkg <unfixed> (static)
145    
146    libyahoo2
147            - centerim <unfixed> (embed; bug #559783)
148    
149    libmsn
150            - centerim <unfixed> (embed; bug #559783)
151    
152    libgadu
153            - centerim <unfixed> (embed; bug #559783)
154            - pidgin <not-affected> (links dynamically since initial release; fixed in gaim)
155            - gaim 1:2.0.0+beta3-3 (embed; bug #360280)
156            - kdenetwork 4:3.3.2-5 (embed)
157            NOTE: from kdenetwork: kopete
158            - ekg 1:1.8~rc0-1 (embed)
159            - kadu 0.6.0.2-3 (embed; bug #504430)
160            - gadu <itp> (embed)
161    
162    xmlrpc (which package is the "origin" of this code?)
163            - drupal <unfixed> (embed)
164            - phpgroupware <unfixed> (embed)
165            - egroupware <unfixed> (embed)
166            - phpwiki <unfixed> (embed)
167            - php4 <unfixed> (embed)
168            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
169    
170    shtool (affects build-time only)
171            - mysql-ocaml <unfixed> (embed)
172            - php4 <unfixed> (embed)
173    
 silc-toolkit:  
 silc-client (uses libsilc and libsilcclient)  
   
 dietlibc:  
 ccontrol (linked statically until 0.9.1+20071204-1, affects Etch only)  
   
 libiax:  
 iaxmodem  
   
 zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  
 dpkg  
 rsync (somehow derived code base)  
 mono  
 mozilla(?)  
 Linux kernels  
 pvpgn (links dynamically since 1.7.8-2)  
 mrtg (links dynamically since 2.12.2-1)  
 rpm  
   
 libbz2:  
 dpkg (statically linked)  
   
 libgadu/ekg:  
 centericq  
 gaim  
 pigdin (links dynamically against libgadu)  
 kopete (ships the code, but links dynamically in the Debian package)  
 kadu (not packaged in Debian)  
 GNU gadu (not yet packaged in Debian)  
   
 xmlrpc: (which package is the "origin" of this code?)  
 drupal  
 phpgroupware  
 egroupware  
 phpwiki  
 php4 (php-pear, IIRC this was reorganized some weeks ago?)  
   
 shtool: (affects build-time only)  
 mysql-ocaml  
 php4  
   
 mozilla:  
 mozilla-firefox  
 mozilla-thunderbird  
 firefox (to be removed)  
 thunderbird (to be removed)  
 iceweasel  
 iceape  
 icedove  
174  xulrunner  xulrunner
175  nvu (no longer in Debian)          - iceape <unfixed> (embed; bug #561749)
176            - iceweasel 2.0.0.19 (embed)
177  xli:          - icedove <unfixed> (embed; bug #561750)
178  xloadimage          - kompozer <unfixed> (embed; bug #532168)
179            - galeon 2.0.2-4 (embed)
180  lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)          - epiphany-browser 2.14.3-8 (embed)
181  openmotif          - conkeror 0.9~git080629-2 (embed)
182  xfree86/xorg (in libxpm)          - kazehakase 0.4.2-1 (embed)
183    
184  kerberized apps with BSD origin:  xli
185  krb4          - xloadimage <unfixed> (embed)
186  krb5  
187  heimdal  lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
188            - openmotif <unfixed> (embed)
189  grip: (which pkg is the origin?)          - libxpm <unfixed> (embed)
190  libcdaudio  
191  grip  kerberized apps with BSD origin
192  gnome-vfs (vfs2 as well?)          - krb4 <removed> (embed)
193            - krb5 <unfixed> (embed)
194  fudforum:          - heimdal <unfixed> (embed)
195  phpgroupware-fudforum  
196  egroupware-fudforum (removed from egroupware after sarge)  grip (which pkg is the origin?)
197            - libcdaudio <unfixed>
198  cvs:          - grip <unfixed>
199  gcvs (at least an additional script is included, check if there's more)          - gnome-vfs <unfixed>
200            TODO: check vfs2 as well
201  pcre:  
202  all pythons  fudforum
203  php4 (src included, but Debian package links dynamically)          [etch] - phpgroupware <unfixed> (embed)
204  analog (src included, but Debian package links dynamically)          NOTE: phpgroupware-fudforum
205  libgoffice-1          [sarge] - egroupware-fudforum <removed> (embed)
206  vfu (removed linking against embedded copy in 4.06-4.1; #450754)  
207  tf5 (since 5.0beta7 the Debian package links dynamically)  libbsd
208  monotone (including this starting from 0.37)          - rdate 1:1.2-3 (embed)
209  glib (2.14 series for gregex support, only for udeb, regular packag links dynamic)          - atheme-services <unfixed>
210  apache2 (since 2.0.53-4 uses 040_link_external_pcre patch)          - libbsd-arc4random-perl <unfixed>
211  exim4 (since 4.10-0.srh20.12 uses 36_pcre patch to use external pcre)          - isakmpd <unfixed>
212  yacas (<= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway)          - bsdgames <unfixed> (embed)
213  gtamsanalyzer.app (links dynamically since 0.42-5)          - bsd-mailx <unfixed> (embed)
214            - netcat-openbsd <unfixed> (embed; bug #550611)
215  tiff:          - openssh <unfixed> (embed)
216  wxpythongtk (check, which debian pkg this is in)          - unworkable <unfixed> (embed)
217  older kdegraphics/kpdf releases < 3.3 embedded a copy  
218    cvs
219  uudeview:          - gcvs <unfixed> (embed)
220  libconvert-uulib-perl          NOTE: see cvsunix/src in tarball
221    
222  sqlite: (not affected by security vulnerabilities so far)  pcre3
223  amarok          - php4 <unknown> (embed)
224  monotone          - analog 2:5.23-0woody1 (embed)
225  iceweasel          - goffice <unfixed> (embed)
226            NOTE: libgoffice-*
227  util-linux/mount:          - vfu 4.06-4.1 (embed; bug #450754)
228  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb          - tf5 5.0beta7-1 (embed)
229            - monotone 0.43-1 (embed)
230  webmin:          NOTE: this only affects versions >= 0.37
231  usermin (only in sarge)          - glib2.0 2.15.2-1 (embed)
232            - apache2 2.0.53-4 (embed)
233  sylpheed:          - exim4 4.10-0.srh20.12 (embed)
234  sylpheed-claws          - yacas <unfixed> (embed)
235            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
236  phpsysinfo:          - gtamsanalyzer.app 0.42-5 (embed)
237  egroupware          - tin 980117-1 (embed)
238  phpgroupware          - kazehakase 0.5.2-1
239            - webkit 1.0.1-1 (embed)
240  phpldapadmin:          - qt4-x11 <unfixed> (embed)
241  egroupware (removed from egroupware after sarge)          NOTE: embedded via webkit copy
242            - erlang <unfixed> (embed)
243  chmlib:          - ssed <unfixed> (embed)
244  kchmviewer (ships the code but links dynamically)  
245    tiff
246  libavcodec/libavformat (source: ffmpeg):          - wxwindows2.4 2.2.1 (embed)
247  mplayer (#395252)          - gamera 3.2.3-1 (embed)
248  xvidcap  
249  kino (links statically, does not include code)  uudeview
250  vlc (links statically, does not include code)          - libconvert-uulib-perl <unfixed> (embed)
251  smilutils (links statically, does not include code)          - pan <unfixed> (embed)
252  motion (links statically, does not include code)  
253  gst-ffmpeg  sqlite (not affected by security vulnerabilities so far)
254  gstreamer0.10-ffmpeg          - amarok <unfixed> (embed)
255  xmovie          - monotone 0.43-1 (embed)
256            - iceweasel <unfixed> (embed)
257            - heimdal <unfixed> (embed; bug #559616)
258    
259    util-linux/mount
260            - loop-aes-utils <unfixed> (embed)
261            NOTE: contains code from util-linux' mount in the mount-aes-udeb
262    
263    sylpheed
264            - sylpheed-claws <unfixed> (fork)
265    
266    phpsysinfo
267            - egroupware <unfixed> (embed)
268            - phpgroupware <unfixed> (embed)
269    
270    phpldapadmin
271            [sarge] - egroupware <unfixed> (embed)
272            NOTE: removed from egroupware after sarge
273    
274    chmlib
275            - kchmviewer <unknown> (embed)
276    
277    ffmpeg (libavcodec/libavformat)
278            - mplayer 1.0~rc2-14 (embed; bug #395252)
279            - kino 1.0.0-1
280            - vlc <not-affected> (Links dynamically since initial release)
281            - smilutils 0.3.0-10
282            NOTE: smilutils likely fixed earlier, marking Etch's version as fixed
283            - motion 3.1.19-1
284            - gstreamer0.10-ffmpeg 0.10.3-2
285            - xmovie <removed> (static)
286            TODO: gimp-gap (potentially using ffmpeg code as well)
287            - avifile 1:0.7.48~20090503.ds-1 (embed; bug #538750)
288            - audacity 1.3.7-2 (embed; bug #512278)
289    
290    faad2
291            - mplayer 1.0~rc2-20 (embed)
292            - avifile <unfixed> (embed; bug #538750)
293            - ffmpeg-debian <removed> (old-version)
294    
295    libmad (MPEG decoding lib)
296            - xine-lib <unfixed> (embed)
297            - avifile 1:0.7.48~20090503.ds-1 (embed) [./plugins/libmad/*]
298            TODO: check ocaml-mad, madplay, pymad, xmms-mad, xmms2
299    
 mad MPEG decoding lib:  
 mad  
 xine-lib  
   
 libdts:  
300  libdts  libdts
301  xine-lib          - xine-lib <unfixed> (embed)
302    
 flac:  
303  flac  flac
304  xine-lib          - xine-lib <unfixed> (embed)
305    
306  liba52:  liba52
307  a52dec          - a52dec <unfixed> (embed)
308  xine-lib          - xine-lib <unfixed> (embed)
309    
310    libmpeg2
311            - mpeg2dec <unfixed> (embed)
312            - xine-lib <unfixed> (embed)
313    
314    libntlm
315            - wget <unfixed> (fork; bug #550436)
316            - curl <unfixed> (fork; bug #550437)
317            - cntlm <unfixed> (fork; bug #550438)
318    
319    uw-imap
320            - pine <unfixed> (embed)
321            - alpine <unfixed> (embed)
322    
323    imagemagick
324            - graphicsmagick <unfixed> (fork)
325    
326    python-urlgrabber
327            - mercurial <unfixed> (embed; bug #531062)
328            - w3af <unfixed> (embed; bug #555372)
329            [experimental] - harvestman <unfixed> (embed; bug #555373)
330    
331    beautifulsoup
332            - python-mechanize <unfixed> (embed; bug #555349)
333            - zope2.11 <removed> (embed; bug #555350)
334            - twill <unknown> (embed)
335    
336    halibut
337            - nsis <unfixed> (fork)
338    
339    libghttp
340            - hotway <unfixed> (embed)
341    
342    libsndfile
343            - ardour 1:2.7.1-1 (embed)
344    
345    glibmm2.4
346            - ardour 1:2.7.1-1 (embed)
347    
348    libgnomecanvasmm2.6
349            - ardour 1:2.7.1-1 (embed)
350    
351    libsigc++-2.0
352            - ardour 1:2.7.1-1 (embed)
353    
354    soundtouch
355            - ardour 1:2.7.1-1 (embed)
356    
357    libmms
358            - xine-lib <unfixed> (embed)
359            - mimms <unfixed> (embed)
360    
361    fckeditor
362            - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
363            - moin 1.8.2-2 (embed; bug #452599)
364            - karrigell <removed> (embed; bug #452598)
365            - gforge 4.6.99+svn6225-1 (embed)
366            - request-tracker3.8 <unfixed> (embed)
367            - otrs2 <unfixed> (embed)
368    
369    ipatlas (not packaged in Debian)
370            - moodle <unfixed> (embed; bug #507185)
371    
372    libphp-phpmailer
373            - moodle <unfixed> (embed; bug #507185)
374            - mahara <unfixed> (embed)
375            - symfony <unfixed> (embed)
376            [etch] - phpgroupware <unfixed> (embed)
377            NOTE: phpgroupware-felamimail is only in etch
378            - egroupware <unfixed> (embed; bug #504283)
379            - glpi <unfixed>
380    
381    htmlArea (not packaged in Debian)
382            - moodle <unfixed> (embed)
383    
384    giflib
385            - wine <unfixed> (embed; bug #466181)
386    
387    bennu (not packaged in Debian, http://bennu.sourceforge.net)
388            - moodle <unfixed> (embed)
389    
390    smarty
391            - moodle 1.8.2-2 (embed; bug #471158)
392            - gallery2 2.2.5-2 (embed; bug #471160)
393            - mahara 0.9.2-2 (embed; bug #471201)
394            - gosa 2.4beta1-1 (embed; bug #471200)
395    
396  libmpeg2:  TinyMCE
397  mpeg2dec          - wordpress 2.5.1-3 (embed; bug #478257)
398  xine-lib          - moodle <unfixed> (embed; bug #507185)
399            - knowledgeroot <unfixed> (embed)
400            - joomla <itp> (bug #326398)
401    
402    scintilla (upstream provides static lib, rejected shared lib http://sf.net/support/tracker.php?aid=2488121)
403            - scite <unfixed> (embed)
404            - qscintilla <unfixed> (embed)
405            - qscintilla2 <unfixed> (embed)
406            - geany <unfixed> (fork)
407            - anjuta <unfixed> (embed)
408    
409    libphp-adodb
410            - moodle <unfixed> (embed; bug #507185)
411            NOTE: also AdoDB-XML Schema
412            - gallery2 <unfixed> (embed)
413            - phppgadmin <unfixed> (embed)
414            - egroupware <unfixed> (embed)
415            - phpwiki <unfixed> (embed)
416            - torrentflux 2.0beta1-2 (embed)
417            - ipplan <unfixed> (embed)
418            - typo3-src <unfixed> (embed)
419            - cacti <unknown> (embed)
420            [sarge] - cacti <unfixed> (embed)
421            NOTE: dependency exists, but internal version is used
422            - gforge 4.7~rc2-6 (embed)
423            - mahara <unfixed> (embed)
424    
425    gzip
426            - linux-kernel <unfixed> (embed)
427            NOTE: lib/inflate.c
428            - klibc <unfixed> (embed)
429            NOTE: based on linux-kernel gzip code
430            - busybox <unfixed> (embed)
431    
432    neon
433            - cadaver 0.22.3+debian-1 (embed; bug #188381)
434            - gnome-vfs2 <unfixed> (embed; bug #395874)
435            [etch] - litmus <unfixed> (embed; #395875)
436            - litmus <removed> (embed; #395875)
437            [sarge] - screem <unfixed> (embed)
438            - sitecopy 1:0.16.0-1 (embed; bug #395876)
439            [etch] - tla <unfixed> (embed; bug #395877)
440            [sarge] - tla <unfixed> (embed; bug #395877)
441    
442    libmodplug
443            - gst-plugins-bad0.10 <unfixed> (embed)
444    
445    libvncserver
446            - vino <unfixed> (embed)
447    
448    putty
449            - filezilla <unfixed> (embed)
450    
451    tinyxml (not packaged in Debian; itp bug #531968)
452            - filezilla <unfixed>
453            - crystalspace <unfixed> (embed)
454            - libwfut <unfixed> (embed)
455            - rarian <unfixed> (embed)
456            - bulletml <unfixed> (embed)
457            - pokerth <unfixed> (embed)
458            - qutecom <unfixed> (embed)
459            - sofa-framework <unfixed> (embed)
460            - yate <unfixed> (embed)
461            - antigrav <unfixed> (embed)
462            - balder2d <unfixed> (embed)
463            - cal3d <unfixed> (embed)
464            - criticalmass <unfixed> (embed)
465            - ember <unfixed> (embed)
466            - epiphany <unfixed> (embed)
467            - gambit <unfixed> (embed)
468            - noiz2sa <unfixed> (embed)
469            - ogre <unfixed> (embed)
470            - opencity <unfixed> (embed)
471            - openmovieeditor <unfixed> (embed)
472            - pouetchess <unfixed> (embed)
473            - tecnoballz <unfixed> (embed)
474            - trigger-rally <unfixed> (embed)
475            - xmoto <unfixed> (embed)
476            - mapnik <unknown> (embed)
477            NOTE: uses a different XML parser by default
478            - rrootage 0.23a-6 <embed>
479            NOTE: links to libbulltetml
480            - boson <unknown> (embed)
481            NOTE: the embedded code is unused
482    
483    gv
484            - evince <unfixed> (embed)
485            NOTE: ps/ tree from gv 3.5.8
486            NOTE: evince-gtk is affected (a component of evince source package)
487    
488    libXbae
489            - paw <removed> (embed)
490            [etch] - paw <unfixed> (embed)
491    
492    libgtkhtml
493            - claws-mail-extra-plugins <unfixed> (fork)
494    
495    libXaw
496            - paw <removed> (embed)
497            [etch] - paw <unfixed> (embed)
498            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
499    
500    libgd2
501            - graphviz <unfixed> (embed)
502            NOTE: lib/gd seems to be 2.0.33
503            - wml <unfixed> (embed)
504            - libwmf <unfixed> (embed)
505            NOTE: derived from gd 1.6.3
506    
507    rar
508            - unrar-nonfree <unfixed> (embed)
509    
510    unrar-free (maybe this code is derived from the original rar, too?)
511            - clamav <unfixed> (embed)
512            NOTE: seems to be disabled in default config
513    
514    mplayer (DirectMedia Object loader)
515            - xine-lib <unfixed> (embed)
516            NOTE: src/libw32dll/
517            - vlc <unfixed> (embed)
518            NOTE: modules/codec/dmo/
519            - mplayer 1.0~rc2-20 (embed)
520    
521    libwpd (WordPerfect converter)
522            - openoffice.org <unfixed> (embed)
523    
524    fsplib (http://sourceforge.net/projects/fsp/)
525            - gftp <unfixed> (embed)
526            NOTE: lib/fsplib version 0.3
527    
528    sprng
529            - tree-puzzle <unfixed> (embed)
530    
531    librpcsecgss
532            - krb5 <unfixed> (embed)
533    
534    jasper
535            - ghostscript 8.64~dfsg-2 (embed)
536    
537    libiris
538            - psi <unfixed> (embed)
539            - kdenetwork <unfixed> (embed)
540            NOTE: kopete embeds libiris but links dynamically to libidn
541            - kdegames <unfixed> (embed)
542            NOTE: ksirk/kde4
543    
544    libidn
545            - monotone 0.43-1 (embed)
546            - psi <unfixed> (embed)
547            NOTE: psi embeds libiris which embeds libidn
548            - kdegames <unfixed> (embed)
549            NOTE: kdegames/kde4 embeds libiris which embeds libidn
550    
551    lua5.1
552            - monotone 0.43-1 (embed)
553            - nmap 5.00-1 (embed; bug #527997)
554            [lenny] - nmap <unfixed> (embed; bug #527997)
555            - ocropus <unfixed> (embed)
556            - enigma <unfixed> (embed)
557            NOTE: requires lua built with C++
558            - freeciv <unfixed> (embed)
559            - spring <unfixed> (embed)
560    
561    libbotan
562            - monotone 0.43-1 (embed)
563    
564    NetXX
565            - monotone 0.43-1 (embed)
566    
567    libgc
568            - mono <unfixed> (embed)
569    
570    lzma
571            - p7zip <unfixed> (embed)
572            - xz-utils <unfixed> (fork)
573    
574    lzo
575            - grub2 <unfixed> (embed)
576    
577    yassl
578            - mysql-dfsg-5.0 <unfixed> (embed)
579    
580    pax code
581            - tar <unfixed> (embed)
582            - cpio <unfixed> (embed)
583    
584    t1lib
585            - tetex-bin 2.0.2-1 (embed)
586            - texlive-bin <unknown> (embed)
587    
588    guichan
589            - boswars <unfixed> (embed)
590            NOTE: maintainer notified us, working on it
591    
592    tolua
593            - boswars <unfixed> (embed)
594            NOTE: maintainer notified us, working on it
595            NOTE: actually tolua++
596            - ocropus <unfixed> (embed)
597            NOTE: actually tolua++
598            - freeciv <unfixed> (embed)
599            NOTE: actually tolua++
600            - enigma <unfixed> (embed)
601    
602  curl:  asio-dev
603  wget (code for NTLM authentication)          - luxrender <removed> (embed)
604    
605  TODO evaluate:  xine-lib
606  gimp-gap (potentially using ffmpeg code as well)          - vlc <unfixed> (embed)
607            NOTE: only parts included in modules/access/rtsp
608    
609  uw-imap:  netpbm
610  pine          - tcl8.3 <unfixed> (embed)
611  alpine          - tcl8.4 <unfixed> (embed)
612            - tcl8.5 <unfixed> (embed)
613            NOTE: generic/tkImgGIF.c
614    
615    tk8.5
616            - tk8.0 <removed> (old-version)
617            - tk8.3 <unfixed> (old-version)
618            - tk8.4 <unfixed> (old-version)
619            - perl-tk <unfixable> (fork)
620    
621    samba
622            - mc 2:4.6.2~git20080311-1 (embed)
623            NOTE: maintainer is aware of this, currently searching a solution
624    
625    plib1.8.4c2
626            - boson <unfixed> (fork)
627            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
628    
629    fribidi
630            - quesoglc <unfixed> (embed)
631            NOTE: compiled against system fribidi in Debian - embed only used when fribidi is not available on the system
632    
633    glew
634            - quesoglc <unfixed> (embed; bug #489341)
635            NOTE: waiting on GLEW_MX version of glew (see bug #474488)
636            - trigger <unfixed> (embed)
637            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
638            - trigger-rally <unfixed> (embed)
639            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
640    
641    minorGems (pabs contacted upstream about shared lib, he considers minorGems an 'ever-evolving collection of reusable code fragments' for his own use)
642            - transcend <unfixed> (embed)
643            - cultivation <unfixed> (embed)
644            - passage <unfixed> (embed)
645            - gravitation <unfixed> (embed)
646    
647  imagemagick:  tar
648  graphicsmagick          - libarchive <unfixed> (embed)
649            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
650    
651  halibut:  cpio
652  nsis          - libarchive <unfixed> (embed)
653            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
654    
655  libghttp:  kde4libs
656  hotway          - kdelibs <unfixable> (old-version)
657    
658  libsndfile:  webkit
659  ardour          - qt4-x11 <unfixed> (embed; bug #479851)
660            [etch] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
661            [lenny] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
662            - kde4libs <unfixable> (fork)
663            NOTE: kde4lib's khtml and webkit were forked from khtml (this tracking, which seems
664            NOTE: reversed genesis-wise, is used because of so much other stuff in kde4libs)
665    
666    ftgl
667            - blender 2.46+dfsg-1 (embed)
668    
669    wv
670            - abiword <unfixed>
671    
672    qemu
673            - kvm <unfixed> (embed; bug #543159)
674            NOTE: the kvm package will be removed from sid and squeeze soon (after
675            NOTE: which it will only be in experimental). superceded by qemu-kvm.
676            - qemu-kvm <unfixed> (embed; bug #560853)
677            - xen-3 3.4.2-2 (embed; bug #560856)
678            - xen-unstable <unfixed> (embed; bug #560856)
679    
680    vgabios
681            - kvm <unfixed> (embed; bug #489442)
682    
683    bochs
684            - kvm <unfixed> (embed; bug #489442)
685    
686    speex
687            - vorbis-tools <unfixed> (embed)
688            NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
689            - gst-plugins-good0.10 <unfixed> (embed)
690            - xine-lib <unfixed> (embed)
691            - libfishsound <unfixed> (embed)
692            - libannodex <removed> (embed)
693            - vlc <unfixed> (embed)
694            - xmms-speex <unfixed> (embed)
695            - libsdl-sound1.2 <unfixed> (embed)
696            - sweep <unfixed> (embed)
697    
698    libreadline
699            - magic <itp> (old-version)
700    
701    opcode
702            - ode <unfixed> (embed)
703            NOTE: opcode is not a package in debian, it is just embedded
704            NOTE: http://www.codercorner.com/Opcode.htm
705    
706    gimpact
707            - ode <unfixed> (embed)
708            NOTE: gimpact is not a package in debian, it is just embedded
709            NOTE: http://gimpact.sf.net
710    
711    mochikit
712            - mahara <unfixed> (embed)
713            NOTE: they require extra patches, still unmerged upstream
714            - ntop <unfixed> (embed)
715            - coherence 0.6.2-1 (embed)
716            - paste <unfixed> (embed)
717            - turbogears <unfixed> (embed)
718            - plone3 <removed> (embed)
719            - xulrunner <unfixed> (embed)
720            - libjifty-plugin-chart-perl <unfixed> (embed)
721            - sabnzbdplus <unfixed> (embed)
722            - tgmochikit <unfixed> (embed)
723    
724    prototypejs
725            - netbeans-ide 6.0.1+dfsg-2 (embed)
726            - auth2db 0.2.5-2+dfsg-1 (embed; bug #555218)
727            - webcit <unfixed> (embed; bug #555219)
728            - asterisk 1:1.6.2.0~rc3-1 (embed)
729            - libjson-ruby 1.1.4-1 (embed; bug #555224)
730            - lucene2 2.9.1+ds1-2 (embed; bug #555226)
731            - horde3 <unfixed> (embed)
732            - knowledgeroot 0.9.9.5-1 (embed; bug #555230)
733            - mediatomb <unfixed> (embed; bug #555233)
734            - mt-daapd 0.9~r1696.dfsg-6lenny2 (embed)
735            - ebug-http <removed> (embed; bug #555236)
736            - libaws 2.7-1 (embed; bug #555222)
737            - phpgedview <removed> (embed)
738            - poker-network <removed> (embed; bug #555238)
739            - rails 2.1.0-6 (embed)
740            - wordpress 2.5.0-2 (embed; bug #555243)
741            - zope <not-affected> (the prototypejs embed is not in any of the obvious zope packages, e.g. zope2.9, zope2.10, zope2.11, and zope3)
742            TODO: search through all of the other zope packages
743            - ampache 3.4.1-2 (embed)
744            - exaile 0.2.14+debian-2.1 (embed; bug #555245)
745            - hobix 0.5~svn20070319-4 (embed; bug #555247)
746            - zabbix 1.6.6-4 (embed; bug #555250)
747            - chora2 <unfixed> (embed; bug #555253)
748            - gollem <unfixed> (embed; bug # 555254)
749            - jscropperui 1.2.1-1 (embed; bug #555257)
750            - scriptaculous <not-affected> (uses system prototype.js since initial upload; bug #555260)
751            - ingo1 <unfixed> (embed; bug #555261)
752            - kronolith2 <unfixed> (embed; bug #555262)
753            - activeldap <unfixed> (embed)
754            - libv8 <not-affected> (contains a google-specific implementation of prototype.js)
755            - mantis 1.1.2+dfsg-1 (embed; bug #555265)
756            - otrs2 2.3.4-6 (embed; bug #555267)
757            - webcalendar <unfixed> (embed; bug #555269)
758            - redmine 0.9.0~svn2907-1 (embed; bug #555270)
759            - jifty 0.90519-1 (embed; bug #555271)
760            - jquery 1.4-1 (embed; bug #555272)
761            - passenger 2.2.5debian1-1 (embed; bug #555273)
762            - plone3 <removed> (embed; bug #555275)
763            - wesnoth <not-affected> (prototype.js not included in any of the binary packages; bug #555277)
764            - libhtml-prototype-perl 1.48-3 (embed; bug #538920)
765            - xulrunner <unfixed> (embed)
766            NOTE: included in iceweasel/xulrunner unit tests directory, so may not be security-relevant
767    
768    gdb
769            - insight <unfixed> (embed)
770    
771    e2fsprogs
772            - ldiskfsprogs <unfixable> (fork)
773    
774    quazip (not packaged in Debian)
775            - qcake <unfixed> (embed)
776            NOTE: starting with upstream version 0.6.4
777    
778    exo
779            - pcmanfm <unfixed> (embed; bug #499677)
780            NOTE: slightly modified source code
781    
782    java
783            - openjdk-6 <unfixed>
784            - sun-java5 <unfixed>
785            - sun-java6 <unfixed>
786    
787    libphp-snoopy
788            - ampache 3.4.1-2 (embed; bug #504169)
789            - gforge 4.6.99+svn6094-2 (embed)
790            - mahara 1.0.5-2 (embed; bug #504170)
791            - pixelpost 1.7.1-5 (embed; bug #504171)
792            - mediamate 0.9.3.6-5 (embed; bug #504172)
793            - opendb <removed> (embed; bug #504173)
794            [etch] - opendb <unfixed> (embed; bug #504173)
795            - wordpress 2.5.1-9 (embed; bug #443948)
796            - moodle <unfixed> (embed; bug #507185)
797            [etch] - phpgroupware <unfixed> (embed)
798            NOTE: phpgroupware-felamimail
799            - magpierss 0.72-3 (embed; bug #431089)
800    
801    jquery
802            - zekr <unfixed> (embed)
803            - wordpress <unknown> (embed)
804            - yocto-reader <unfixed> (embed)
805            - textpattern <unfixed> (embed)
806            - genshi 0.5.1-1 (embed)
807            NOTE: compressed file under examples/ dir
808            - prewikka <unfixed> (embed)
809            - libramaze-ruby <unfixed> (embed)
810            - drupal5 <unfixed> (embed)
811            - b2evolution <unfixed> (embed)
812            - wesnoth <unfixed> (embed)
813    
814    tablesorter (jquery plugin, not packaged yet)
815            - wesnoth <unfixed> (embed)
816    
817    kses
818            - wordpress <unfixed> (embed; bug #504242)
819            NOTE: their copy has all methods renamed to wp_<foo>
820            NOTE: kses isn't in Debian, RFP: #504240
821            - moodle <unfixed> (embed; bug #507185)
822            - egroupware <unfixed> (embed)
823    
824    magpierss
825            - wordpress <unfixed> (embed; bug #504242)
826            - moodle <unfixed>
827    
828    php-gettext
829            - wordpress 2.8.4-1 (embed; bug #504242)
830            - docbookwiki <unfixed> (embed)
831            - knowledgeroot 0.9.9.5-1
832            NOTE: non-free
833    
834    libphp-ixr (name may change, it is the Incutio XML-RPC)
835            - wordpress <unfixed> (embed; bug #504242)
836            NOTE: libphp-ixr isn't in Debian, RFP: #504236
837            - dokuwiki <unfixed> (embed)
838            - textpattern <unfixed> (embed)
839    
840    libphp-cas
841            - glpi <unfixed> (embed)
842            - moodle <unfixed> (embed; bug #505984)
843    
844    scriptaculous (prototype.js is among the embeds in the following)
845            - glpi <unfixed> (embed)
846            - libaws <unfixed> (embed; bug #555222)
847            - op-panel <unfixed> (embed)
848            - symfony <unfixed> (embed)
849            NOTE: maintainer says there are extra incompatible changes required
850            - pixelpost 1.7.1-6 (embed)
851            - webhelpers <unfixed> (embed)
852            - qwik <removed> (embed; bug #555241)
853            - smokeping <unfixed> (embed)
854            - turba2 <unfixed> (embed)
855            - typo3-src 4.2.3-1 (embed)
856            - request-tracker3.6 <unfixed> (embed)
857            - request-tracker3.8 <unfixed> (embed)
858            - rt-extension-emailcompletion <not-affected> (prototype.js not included in the binary package)
859            - wordpress 2.5.0-2 (embed)
860            - libhtml-prototype-perl 1.48-3 (embed)
861    
862    libmarkdown-php
863            - moodle <unfixed> (embed; bug #507185)
864            - pixelpost 1.7.1-6 (embed)
865    
866    php-openid
867            - wordpress-openid <itp> (embed)
868    
869    geshi
870            - dokuwiki 0.0.20080505-3.1 (embed)
871            - pgfouine 1.0-1.1 (embed)
872            - websvn 2.1.0-1 (embed)
873    
874    webcalendar
875            - gforge 4.7~rc2-6 (embed; bug #504758)
876    
877    libical
878            - kdepim <unknown> (fork)
879            NOTE: fixed at some point during 4.0
880            - kdepimlibs 4.2.0-1 (fork)
881            - claws-mail-extra-plugins <unfixed> (fork)
882    
883    libltdl3
884            - kdelibs <unfixed> (embed)
885            NOTE: it's been said it sets RT_GLOBAL (or something like that) at runtime and version in experimental of libltdl can optionally set it
886            - synfig <unfixed> (embed)
887    
888    harfbuzz
889            - qt4-x11 <unfixed> (embed)
890            - pango1.0 <unfixed> (embed)
891            - fontmatrix <unfixed> (embed)
892    
893    libzip
894            - php5 <unfixable> (modified-embed)
895            - odt2txt <unfixed> (embed; bug #523808)
896    
897    json.php (not packaged; should be replaced with php's built-in functions)
898            - moodle <unfixed>
899            - yui <unfixed>
900            - gallery2 <unfixed>
901            - dokuwiki <unfixed>
902            - typo3-src <unfixed>
903    
904    php-fpdf
905            - tcpdf <itp> (fork)
906            - moodle <unfixed>
907            - phpwiki <unfixed>
908            - egroupware <unfixed>
909            - ldap-account-manager <unfixed> (fork)
910    
911    tcpdf (itp: #495985)
912            - moodle <unfixed>
913            - phpmyadmin <unfixed>
914    
915  glibmm2.4:  typo3
916  ardour          - moodle <unfixed>
917    
918  libgnomecanvasmm2.6:  spreadsheet_writeexcel (PHP port of libspreadsheet-writeexcel-perl; itp: #487557)
919  ardour          - moodle <unfixed>
920            - gosa <unfixed>
921    
922    php-ole (itp: #487558)
923            - moodle <unfixed>
924    
925    pieforms (http://www.catalyst.net.nz)
926            - mahara <unfixed>
927    
928    savant2 (http://phpsavant.com)
929            - egroupware <unfixed>
930    
931    rssparser (http://nwow.org)
932            - egroupware <unfixed>
933            - phpgroupware <unfixed>
934    
935    lcms
936            - openjdk-6 <unfixed> (fork)
937    
938    libphp-phplayersmenu
939            - diogenes <unfixed>
940            - phpldapadmin <unfixed>
941    
942    libphp-pclzip
943            - docvert <unfixed>
944            - moodle <unfixed>
945            - egroupware <unfixed>
946    
947    libphp-simplepie
948            - dokuwiki <unfixed>
949            - wordpress <unfixed>
950    
951    libphp-jpgraph
952            - egroupware <unfixed>
953    
954    php-simpletest
955            - moodle <unfixed>
956    
957    libpng
958            - iceweasel <not-affected> (uses xulrunner)
959            - icedove 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1, 2.0.0.19-1 (embed)
960            - iceape 1.0.13~pre080614i-0etch1 (embed)
961            - xulrunner 1.9.0.13-1 (embed)
962            [lenny] - xulrunner 1.9.0.11-0lenny1
963            [etch] - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
964            - gamera 3.2.3-1 (embed)
965    
966    irssi
967            - silc-client <unfixed> (embed)
968            NOTE: Seems to be a pre-0.8.12 version that is used in irssi-plugin-silc
969    
970    extc
971            - mtasc <unfixed> (embed)
972            - haxe <unfixed> (embed)
973    
974    swflib
975            - mtasc <unfixed> (embed)
976            - haxe <unfixed> (embed)
977    
978    libitext-java
979            - bouncycastle 2.1.4-1 (embed)
980    
981    python-ply
982            - pyke <unfixed> (embed; bug #555363)
983            - pywbem 0.7.0-4 (embed; bug #555364)
984            - sepolgen <unfixed> (embed; bug #555365)
985            - zope-textindexng3 <unknown> (embed)
986            - iceweasel <not-affected> (uses xulrunner)
987            - xulrunner <unknown> (embed)
988            - wireshark <not-affected> (python-ply modules are not installed into binary packages; see #554613)
989    
990    libdumbnet (libdnet upstream)
991            - nmap <unfixed> (fork)
992    
993    gcc-4.4
994            - gcc-mingw32 <unfixed> (embed)
995    
996    camlimages
997            - advi <unfixed> (static; bug #550441)
998    
999    memcached
1000            - memcachedb <unfixed> (embed)
1001    
1002    yajl
1003            - argyll <unfixed> (embed; bug #544223)
1004            NOTE: reference, confirmed by build logs: http://lists.debian.org/debian-mentors/2009/08/msg00062.html
1005    
1006    nusoap
1007            - gforge 4.8.2-1 (embed)
1008            - ampache <unfixed> (embed)
1009            - poker-network <unfixed> (old-version)
1010            - moodle <unfixed> (old-version)
1011            NOTE: code is not used when running under php5 and soap is enabled
1012            - phpwiki <unfixed> (old-version)
1013            - gallery2 <unfixed> (old-version)
1014            - typo3-src <unfixed> (old-version)
1015    
1016    libept
1017            - adept <unfixed> (embed; bug #540649)
1018    
1019    libvorbis
1020            - iceweasel <not-affected> (uses xulrunner)
1021            - xulrunner <unfixed> (embed; bug #540959)
1022            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1023            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1024            - iceape <unfixed> (embed)
1025            [etch] - iceape <not-affected> (introduced in 2.0)
1026            [lenny] - iceape <not-affected> (introduced in 2.0)
1027    
1028    cairo
1029            - iceweasel <not-affected> (uses xulrunner)
1030            - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
1031    
1032    liboggz
1033            - iceweasel <not-affected> (uses xulrunner)
1034            - xulrunner <unfixed> (embed; bug #540959)
1035            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1036            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1037            - iceape <unfixed> (embed)
1038            [etch] - iceape <not-affected> (introduced in 2.0)
1039            [lenny] - iceape <not-affected> (introduced in 2.0)
1040    
1041    liboggplay
1042            - iceweasel <not-affected> (uses xulrunner)
1043            - xulrunner <unfixed> (embed; bug #540959)
1044            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1045            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1046            - iceape <unfixed> (embed)
1047            [etch] - iceape <not-affected> (introduced in 2.0)
1048            [lenny] - iceape <not-affected> (introduced in 2.0)
1049    
1050    php-net-dnsbl
1051            - serendipity <unfixed> (embed; bug #541740)
1052    
1053    php-onyx-rss
1054            - serendipity <unfixed> (embed; bug #541740)
1055    
1056    php-text-wiki
1057            - serendipity <unfixed> (embed; bug #541740)
1058    
1059    php-xml-rpc
1060            - serendipity <unfixed> (embed; bug #541740)
1061    
1062    polarssl (does not have a shared library)
1063            - pdkim <itp> (embed; bug #543150)
1064            - xyssl <unfixed> (old-version)
1065    
1066    pidgin
1067            - gaim <removed> (old-version)
1068            - qutecom <unfixed> (embed; bug #559785)
1069    
1070    icu
1071            - webkit 1.0.1-1 (embed; bug #547214)
1072            - texlive-bin <unfixed> (fork)
1073            NOTE: texlive upstream working with icu upstream to merge their changes
1074    
1075    cyrus-imapd-2.2
1076            - kolab-cyrus-imapd <unfixed> (fork)
1077            - dovecot 1:1.2.1-1 (embed) [/dovecot-sieve/src/libsieve/*]
1078    
1079    python-cxx-dev
1080            - freecad 0.9.2646.3-1 (embed; bug #547936)
1081    
1082    zipios++
1083            - freecad 0.9.2646.3-1 (embed; bug #547941)
1084            - enigma 0.92.3-3 (embed)
1085            NOTE: likely fixed earlier, marking etch's version as fixed
1086    
1087    linux-2.6
1088            - kvm <removed> (embed; bug #549973) [./kernel/*]
1089            - linux-kbuild-2.6 <unfixed> (embed; bug #550379) [./kbuild/*]
1090            - kernel-source-2.6.8 <removed> (old-version)
1091            - kernel-source-2.4.27 <removed> (old-version)
1092            - kernel-source-2.4.24 <removed> (old-version)
1093            - kernel-source-2.2.25 <removed> (old-version)
1094            - kernel-source-2.2.20 <removed> (old-version)
1095    
1096    libfdt (not yet packaged separately for debian; http://www.jdl.com/software/)
1097            - kvm <removed> (embed) [./libfdt/*]
1098            - qemu-kvm <unfixed> (embed) [./libfdt/*]
1099    
1100    qweb (not packaged)
1101            - ajaxterm <unfixed>
1102    
1103    opensaml2
1104            - opensaml <removed> (old-version)
1105    
1106    shibboleth-sp2
1107            - shibboleth-sp <removed> (old-version)
1108    
1109    tuxonice-userui
1110            - suspend2-userui <removed> (old-version)
1111    
1112    expat
1113            - w3c-libwww <removed> (embed; bug #551941)
1114            [etch] - w3c-libwww <unfixed> (embed; bug #551941) [./modules/expat/*]
1115            - python-xml <unfixed> (embed; bug #551940) [./extensions/expat/*]
1116            - python2.5 <unfixable> (embed; bug #553403) [./Modules/expat/*]
1117            - python2.4 <unfixable> (embed; bug #553403)
1118            - python-4suite <unfixed> (embed; bug #516935)
1119            - wxwindows2.4 <removed> (embed)
1120            - wxwidgets2.6 2.6.3.2.2-4 (embed)
1121            - wxwidgets2.8 2.8.10.1-2 (embed)
1122            - celementtree 1.0.5-8 (embed)
1123            NOTE: Maybe that was fixed even earlier
1124            - audacity 1.3.2-1 (embed)
1125            - matanza <unfixed> (embed)
1126            - tdom 0.8.3~20080525-1 (embed)
1127            - udunits 2.1.8-4 (embed)
1128            - apr-util 1.2 (embed)
1129            - ayttm <unfxed> (embed; bug #561006)
1130            - cableswig <unfixed> (embed)
1131            - cadaver <unfixed> (embed)
1132            - cmake 2.6.0-6 (embed)
1133            - coin3 <unfixed> (embed)
1134            - gdcm 2.0.14-2 (embed)
1135            - ghostscript <unfixed> (embed)
1136            - grmonitor <removed> (embed)
1137            - iceape <unfixed> (embed)
1138            - insighttoolkit 3.16.0-1 (embed)
1139            NOTE: insighttoolkit might've been fixed earlier
1140            - libparagui1.1 1.0.2-1 (embed)
1141            - paraview <unfixed> (embed)
1142            - poco <unfixed> (embed)
1143            - simgear <unfixed> (embed)
1144            - sitecopy 1:0.16.0-1
1145            - smart 1.0-1 (embed)
1146            - swish-e <not-affected> (Linked against libxml, which is used instead)
1147            - tla 1.3.5+dfsg-15 (embed)
1148            - vtk 4.1.20030227-1 (embed)
1149            - wbxml2 <unfixed> (embed)
1150            - xmlrpc-c <unfixed> (embed)
1151            - iceweasel <unfixed> (embed)
1152            - kompozer <unfixed> (embed)
1153            - vxl 1.13.0-2 (embed)
1154            - xulrunner <unfixed> (embed)
1155            - apache2 2.2 (embed)
1156            - texlive-bin <not-affected> (Embedded code not compiled in)
1157            - vnc4 <unfixed> (embed)
1158            - xotcl <unfixed> (embed)
1159    
1160    xerces-c
1161            - xerces-c2 <unfixed> (old-version)
1162            - xerces27 <removed> (old-version)
1163    
1164    md5 (RSA's version; not the gnu version provided by coreutils)
1165            - w3c-libwww <removed> (embed; bug #551942)
1166            [etch] - w3c-libwww <unfixed> (embed; bug #551942) [./modules/md5/*]
1167    
1168    enet
1169            - sauerbraten <unfixed> (embed; #497194)
1170    
1171    eglibc
1172            - glibc <removed> (old-version)
1173    
1174    galib
1175            - gamera 3.2.3-1 (embed)
1176    
1177    configobj
1178            - bzr <unfixed> (embed; bug #555336)
1179            - elisa <unfixed> (embed; bug #555337)
1180            - gaupol <unfixed> (embed; bug #555338)
1181            - ipython <unfixed> (embed; bug #555339)
1182            - pida <unfixed> (embed; bug #555340)
1183            - psychopy <unfixed> (embed; bug #555341)
1184            - rest2web <unfixed> (embed; bug #555342)
1185            - auth2db <unknown> (embed)
1186            - dynagen <unknown> (embed)
1187            - iceweasel <unknown> (embed)
1188            - sabnzbdplus <unknown> (embed)
1189            - xulrunner <unknown> (embed)
1190            - nipy <not-affected> (part of an example [/examples/neurospin/neurospy/configobj.py], which is not installed into binary packages)
1191    
1192    python-clientform
1193            - bibus <unfixed> (embed; bug #555332)
1194            - zope2.10 <unfixed> (embed; bug #555333)
1195            - zope2.11 <removed> (embed; bug #555334)
1196            - python-mechanize <unknown> (embed)
1197            - twill <unknown> (embed)
1198    
1199    python-mechanize
1200            - zope2.10 <unfixed> (embed; bug #555337)
1201            - zope2.11 <removed> (embed; bug #555338)
1202            - twill <unknown> (embed; bug #555339)
1203    
1204    pexpect
1205            - duplicity 0.6.06-1 (embed; bug #555361)
1206            - hplip <unfixed> (embed; bug #555362)
1207            - smart <unfixed> (embed; bug #555363)
1208    
1209    pyparsing
1210            - bauble <unfixed> (embed; bug #555366)
1211            - boa-constructor 0.6.1-8 (embed; bug #555367)
1212            - calibre <unfixed> (embed; bug #555368)
1213            - matplotlib <unfixed> (embed; bug #531024)
1214            - zhpy <unfixed> (embed; bug #555370)
1215            - polybori <unknown> (embed)
1216            - python-whoosh <unknown> (embed)
1217            - twill <unknown> (embed)
1218            - zope-textindexng3 <unknown> (embed)
1219    
1220    python-pysqlite2
1221            - python2.4 <unfixed> (embed; bug #553403)
1222            - python2.5 <unfixed> (embed; bug #553403)
1223    
1224    celementtree
1225            - python2.5 <unfixed> (embed)
1226            - smart 1.0-1 (embed)
1227            [etch] - smart <unfixed> (embed)
1228    
1229    elementtree
1230            - python2.5 <unfixed> (embed)
1231            - bzr <unfixed> (embed; bug #555343)
1232            - gedit 2.28.2-1 (embed; bug #555344)
1233            - smart 1.0-1 (embed)
1234            [etch] - smart <unfixed> (embed)
1235            - solfege <unfixed> (embed; bug #555345)
1236            - w3af <unfixed> (embed; bug #555346)
1237            - python-qt4 <unknown> (embed)
1238            - sphinx <unknown> (embed)
1239            - python-nltk <itp> (embed)
1240    
1241    python2.5
1242            - python2.4 <unfixed> (old-version)
1243            - jython <unfixed> (embed)
1244            NOTE: embeds many stdlib modules
1245            - python-django <unfixed> (embed; bug #555419)
1246            NOTE: embeds stdlib modules: doctest, decimal
1247            - gamera 3.2.3-1 (embed)
1248            NOTE: embeds stdlib modules: ConfigParser, optparse, sets, textwrap
1249            - boa-constructor <unfixed> (embed; bug #555426)
1250            NOTE: embeds stdlib modules: ConfigParser, tarfile, zipfile, xmlrpclib
1251            - nicotine <unfixed> (embed; bug #555427)
1252            NOTE: embeds stdlib modules: ConfigParser
1253            - museek+ <unfixed> (embed; bug #555428)
1254            NOTE: embeds stdlib modules: ConfigParser
1255            - vegastrike-data <unfixed> (embed)
1256            NOTE: embeds many stdlib modules
1257            - codespeak-lib 1.1.1-1 (embed; bug #555420)
1258            NOTE: embeds stdlib modules: doctest, optparse, subprocess, textwrap
1259            - config-manager <unfixed> (embed; bug #555423)
1260            NOTE: embeds stdlib modules: optparse
1261            - jhbuild 2.28.0-1 (embed; bug #555421)
1262            NOTE: embeds stdlib modules: optparse, subprocess
1263            - smart <unfixed> (embed; bug #555432)
1264            NOTE: embeds stdlib modules: optparse
1265            - pyprotocols 1.0a.svn20070625-5 (embed; bug #555433)
1266            NOTE: embeds stdlib modules: doctest
1267            - ruledispatch 0.5a.svn20080510-4 (embed; bug #555434)
1268            NOTE: embeds stdlib modules: doctest
1269            - distribute <unfixed> (embed)
1270            NOTE: embeds stdlib modules: doctest
1271            - python-setuptools <unfixed> (embed; bug #555435)
1272            NOTE: embeds stdlib modules: doctest
1273            - zope.testing <unfixed> (embed; bug #555436)
1274            NOTE: embeds stdlib modules: doctest
1275            - translate-toolkit <unfixed> (embed; bug #555422)
1276            NOTE: embeds stdlib modules: textwrap, contextlib
1277            - libtpclient-py <unfixed> (embed; bug #555424)
1278            NOTE: embeds stdlib modules: subprocess
1279            - grass <unfixed> (embed; bug #555425)
1280            NOTE: embeds stdlib modules: subprocess
1281            - coherence <unfixed> (embed; bug #555429)
1282            NOTE: embeds stdlib modules: uuid
1283            - python-django-extensions 0.4.2pre+git200911182050-1 (embed; bug #555430)
1284            NOTE: embeds stdlib modules: uuid
1285            - setroubleshoot <unfixed> (embed; bug #555431)
1286            NOTE: embeds stdlib modules: uuid
1287            - linkchecker <unfixed> (embed; bug #555414)
1288            NOTE: embeds msgfmt.py script
1289            - imdbpy <unfixed> (embed)
1290            NOTE: embeds msgfmt.py script
1291            - kiwi <unfixed> (embed)
1292            NOTE: embeds msgfmt.py script
1293            - moin <unfixed> (embed)
1294            NOTE: embeds msgfmt.py script, stdlib modules: cgitb, difflib, tarfile
1295            - plone3 <removed> (embed)
1296            NOTE: embeds msgfmt.py script
1297            - roundup <unfixed> (embed)
1298            NOTE: embeds msgfmt.py script, stdlib modules: cgitb
1299            - rednotebook <unfixed> (embed; bug #555415)
1300            NOTE: embeds msgfmt.py script
1301            - turbogears <unfixed> (embed)
1302            NOTE: embeds msgfmt.py script
1303            - elisa <unfixed> (embed)
1304            NOTE: embeds msgfmt.py script, stdlib modules: uuid
1305            - calibre <unfixed> (embed)
1306            NOTE: embeds msgfmt.py script, stdlib modules: zipfile
1307            - mailman 1:2.1.13-1 (embed; #555416)
1308            NOTE: embeds msgfmt.py script
1309            - python-docutils <unknown> (embed)
1310            NOTE: embeds stdlib modules: optparse, textwrap
1311            - python-imaging <unknown> (embed)
1312            NOTE: embeds stdlib modules: doctest
1313            - python-mechanize <unknown> (embed)
1314            NOTE: embeds stdlib modules: doctest
1315            - twill <unknown> (embed)
1316            NOTE: embeds stdlib modules: subprocess
1317            - zeroc-ice <unknown> (embed)
1318            NOTE: embeds stdlib modules: subprocess
1319            - wxwidgets2.8 <unknown> (embed)
1320            NOTE: embeds stdlib modules: subprocess
1321            - cycle <unknown> (embed)
1322            NOTE: embeds msgfmt.py script
1323            - deluge <unknown> (embed)
1324            NOTE: embeds msgfmt.py script
1325            - opendict <unknown> (embed)
1326            NOTE: embeds msgfmt.py script
1327            - openerp-client <unknown> (embed)
1328            NOTE: embeds msgfmt.py script
1329            - rapidsvn <unknown> (embed)
1330            NOTE: embeds msgfmt.py script
1331            - wammu <unknown> (embed)
1332            NOTE: embeds msgfmt.py script
1333            - gaphor <unknown> (embed)
1334            NOTE: embeds msgfmt.py script
1335            - pida <unknown> (embed)
1336            NOTE: embeds msgfmt.py script
1337            - python-formencode <unknown> (embed)
1338            NOTE: embeds msgfmt.py script
1339            - duplicity <unfixed> (embed)
1340            NOTE: embeds stdlib module: urlparse, tarfile
1341            - pygopherd <unfixed> (embed)
1342            NOTE: embeds stdlib module: zipfile
1343    
1344    argparse
1345            - twill <unfixed> (embed; bug #555347)
1346            - ipython <unfixed> (embed; bug #555348)
1347    
1348    coherence
1349            - elisa <unfixed> (embed; bug #555335)
1350    
1351    simpletal
1352            - plastex <unfixed> (embed; bug #555371)
1353    
1354    flickrpc (not packaged in Debian, http://burtonini.com/bzr/flickrpc/)
1355            - postr <unfixed> (embed)
1356            - elisa <unfixed> (embed)
1357    
1358    simplegeneric (not packaged in Debian, http://pypi.python.org/pypi/simplegeneric)
1359            - apertium-tolk <unfixed> (embed)
1360            - ipython <unfixed> (embed)
1361            - virtaal <unfixed> (embed)
1362    
1363    distribute
1364            - setuptools <removed> (old-version)
1365    
1366    rails
1367            - jruby1.2 <unfixed> (embed) [./bench/rails/*]
1368            - libgettext-ruby <unfixed> (embed) [./samples/rails/*]
1369            - libopenid-ruby <unfixed> (embed) [./examples/rails_openid/*]
1370            - thin <unfixed> (embed) [./spec/rails_app/*]
1371            NOTE: this is a subdirectory of examples, which in general is a non-issue, but may
1372            NOTE: be dangerous if developers are naively basing their code off of the examples
1373            NOTE: prototype.js is among the example files
1374    
1375    lucene2 (prototype.js is among the embeds in the following)
1376            - lucene <unfixed> (old-version)
1377            - pylucene <unfixed> (embed)
1378            - libpdfbox-java <unfixed> (embed)
1379            - libfontbox-java <unfixed> (embed)
1380            - libjempbox-java <unfixed> (embed)
1381            - solr <unfixed> (embed)
1382    
1383    unicode-data
1384            - syslinux <unfixed> (embed)
1385            - camomile <unfixed> (embed)
1386            - fribidi <unfixed> (embed)
1387            - m17n-db <unfixed> (embed)
1388            - sbcl <unfixed> (embed)
1389            - heimdal <unfixed> (embed)
1390            - icu <unfixed> (embed)
1391            - icu4j <unfixed> (embed)
1392            - krb5 <unfixed> (embed)
1393            - moodle <unfixed> (embed)
1394            - openldap <unfixed> (embed)
1395            - pike7.6 <unfixed> (embed)
1396            - samba <unfixed> (embed)
1397            - samba4 <unfixed> (embed)
1398            - cmucl <unfixed> (embed)
1399            - typo3-src <unfixed> (embed)
1400            - mauve <unfixed> (embed)
1401            - texlive-bin <unfixed> (embed)
1402            - ypsilon <unfixed> (embed)
1403            - jeuclid <unfixed> (embed)
1404            - charmap.app <unfixed> (embed)
1405            - clisp <unfixed> (embed)
1406            - gnulib <unfixed> (embed)
1407            - opensrs-client <unfixed> (embed)
1408            - saxonb <unfixed> (embed)
1409            - rails <unfixed> (embed)
1410    
1411    feedparser
1412            - rawdog <unfixed> (embed; bug #383422)
1413            - miro <unfixed> (embed; bug #555351)
1414            - calibre <unfixed> (embed; bug #555352)
1415            - freevo <unfixed> (embed; bug #555353)
1416            - pida <unfixed> (embed; bug #555354)
1417            - planet-venus <unfixed> (embed; bug #555355)
1418            - plone3 <removed> (embed; bug #555356)
1419            - exaile 0.2.14+debian-1 (embed)
1420            - screenlets 0.1.2-3 (embed)
1421            NOTE: included twice
1422    
1423    agg:
1424            - matplotlib <unfixed> (embed: bug #377271)
1425            - contextfree <unfixed> (embed)
1426            NOTE: since 2.2-1 it links statically to system libagg, but still uses the embedded copy
1427            - exactimage <unfixed> (embed)
1428            - python-enable <unfixed> (embed)
1429            - mapnik 0.5.1-3 (embed)
1430            NOTE: links statically to agg, but shared library is not available (bug #377271)
1431    
1432    vtk
1433            - paraview <unfixable> (embed; bug #495426)
1434    
1435    txt2tags
1436            - rednotebook <unfixed> (embed)
1437    
1438    htmltextview (not packaged in Debian, http://www.gnome.org/~gjc/htmltextview.py)
1439            - gajim <unfixed> (embed)
1440            - emesene <unfixed> (embed)
1441            - convirt <unfixed> (embed)
1442            - pida <unfixed> (embed)
1443            - rednotebook <unfixed> (embed)
1444    
1445    horde3 (prototype.js is among the embeds in the following)
1446            - mnemo2 <unfixed> (embed)
1447            - nag2 <unfixed> (embed)
1448            - wordpress <unfixed> (embed)
1449            NOTE: Text_Diff (wp-includes/Text/Diff*)
1450    
1451  libsigc++-2.0:  cimg
1452  ardour          - gmic <itp> (embed)
1453    
1454  soundtouch:  mootools
1455  ardour          - gmic <itp> (embed)
1456    
1457  libmms:  openldap
1458  xine-lib          - openldap2.3 <removed> (old-version)
 mimms  
1459    
1460  FCKeditor: (packaged as fckeditor)  grub2
1461  knowledgeroot          - grub <unfixed> (old-version)
 moin (452599)  
 karrigell (452598)  
 gforge-plugins-extra (fixed since 4.6.99+svn6225-1)  
1462    
1463    gnupginterface
1464            - duplicity <unfixed> (embed)
1465    
1466    python-dateutil
1467            - awn-extras-applets <unfixed> (embed)
1468            - matplotlib <unknown> (embed)
1469    
1470    cups
1471            - cupsys <removed> (old-version)
1472    
1473    yui
1474            - bcfg2 <not-affected> (present in source but not included in any binary files)
1475            - serendipity <unfixed> (embed; bug #557746)
1476            - moodle 1.8.2.dfsg-5 (embed)
1477            - jifty 0.91117-1 (embed; bug #557748)
1478            - webgui 7.7.26-1 (embed)
1479            - loggerhead 1.17-1 (embed)
1480    
1481    quake3 (vanilla source not packaged in debian)
1482            - openarena <unfixable> (fork)
1483    
1484    quake2 (vanilla source not packaged in debian)
1485            - alien-arena <unfixable> (fork)
1486            - warsow <unfixable> (fork)
1487    
1488    libtheora
1489            - iceweasel <not-affected> (uses xulrunner)
1490            - xulrunner <unfixed> (embed; bug #540959)
1491            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1492            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1493            - iceape <unfixed> (embed; bug #559276)
1494            [etch] - iceape <not-affected> (introduced in iceape 2.0)
1495            [lenny] - iceape <not-affected> (introduced in iceape 2.0)
1496    
1497    dtoa
1498            - bfilter <unfixed> (embed)
1499            - cacao <unfixed> (embed)
1500            - cdrdao <unfixed> (embed)
1501            - classpath <unfixed> (embed)
1502            - freej <unfixed> (embed)
1503            - iceape <unfixed> (embed)
1504            - iceweasel <unfixed> (embed)
1505            - jscoverage <unfixed> (embed)
1506            - kde4libs <unfixed> (embed)
1507            - kdelibs <unfixed> (embed)
1508            - kompozer <unfixed> (embed)
1509            - libv8 <unfixed> (embed)
1510            - mono <unfixed> (embed)
1511            - newlib <unfixed> (embed)
1512            - nspr <unfixed> (embed)
1513            - php5 <unfixed> (embed)
1514            - polyml <unfixed> (embed)
1515            - qt4-x11 <unfixed> (embed)
1516            - rhino <unfixed> (embed)
1517            NOTE: code translated to Java
1518            - ruby1.8 <unfixed> (embed)
1519            - ruby1.9 <unfixed> (embed)
1520            - ruby1.9.1 <unfixed> (embed)
1521            - sdd <unfixed> (embed)
1522            - sfind <unfixed> (embed)
1523            - star <unfixed> (embed)
1524            - tinymux <unfixed> (embed)
1525            - virtualbox-ose <unfixed> (embed)
1526            - webkit <unfixed> (embed)
1527            - xulrunner <unfixed> (embed)
1528    
1529    ipc (not packaged in Debian; see http://mozdev.org/pipermail/enigmail/2009-November/011678.html)
1530            - firegpg <unfixed> (embed)
1531            - enigmail <unfixed> (embed)
1532    
1533    ptmalloc (not packaged in Debian)
1534            - crystalspace <unfixed> (embed)
1535            - qt4-x11 <unfixed> (embed)
1536    
1537    svgalib
1538            - usplash <unfixed> (embed)
1539    
1540    bogl
1541            - usplash <unfixed> (embed)
1542    
1543    taglist
1544            - usplash <unfixed> (embed)
1545    
1546    portaudio
1547            - audacity <unfixed> (embed; bug #323711)
1548    
1549    nyquist
1550            - audacity <unfixed> (embed)
1551            NOTE: embeds a forked nyquist with support for a shared library
1552    
1553  Moodle contains lots of things:  vamp-plugin-sdk
1554  AdoDB          - audacity <unfixed> (embed)
 AdoDB-XML Schema  
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
 TinyMCE  
 bennu  
1555    
 TinyMCE:  
1556  wordpress  wordpress
1557  moodle          - libwordpress-xmlrpc-perl <removed> (embed) [./xmlrpc.php]
 knowledgeroot  
 joomla (ITP)  
   
 scintilla:  
 scite  
 qscintilla  
 qscintilla2  
 geany  
   
 libphp-adodb:  
 gallery2  
 phppgadmin  
 egroupware  
 phpwiki  
 ipplan  
 typo3  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
   
 gzip:  
 linux-kernel (lib/inflate.c)  
 klibc (based on linux-kernel gzip code)  
 busybox  
   
 neon:  
 cadaver (all, but being worked on: #188381)  
 gnome-vfs2 (#395874)  
 litmus (#395875)  
 screem (sarge only)  
 sitecopy (#395876)  
 tla (etch/sid only: #395877)  
   
 libmodplug:  
 gst-plugins-bad0.10  
1558    
1559  libvncserver:  php5
1560  vino          - php4 <removed> (old-version)
1561    
1562  putty:  classpath
1563  filezilla          - libgnucrypto-java <unfixed> (embed; bug #559788)
1564    
1565  tinyxml (not packaged in Debian):  libtool
1566  filezilla          - apr <unfixed> (static; bug #489625)
1567            NOTE: ships copy of libtool in libapr1-dev; was 'embed' before 1.3.2-3
1568            - arts <unfixed> (embed)
1569            - bochs 2.4.2-1 (embed; bug #560884)
1570            - camserv <unfixed> (embed)
1571            - collectd <unfixed> (embed)
1572            - courier-authlib 0.58-4 (embed)
1573            NOTE: The etch version of courier-authlib was the earliest version checked, might be fixed earlier
1574            - cvsnt <unfixed> (embed)
1575            - dico <not-affected> (Uses the system copy of ltdl)
1576            - freeradius 0.1+20010527-1 (embed)
1577            NOTE: Earliest reference I could find from the changelog is from 27 May 2001
1578            - ggobi 2.1.9~20091212-1 (embed)
1579            - glame 2.0.1-4 (embed)
1580            NOTE: The etch version of glame was the earliest version checked, might be fixed earlier
1581            - gnash <unfixed> (embed)
1582            - gnu-smalltalk <unfixed> (embed)
1583            - google-gadgets 0.10.5-0.3 (embed)
1584            NOTE: 0.10.5-0.3 was the earliest version checked, was fixed earlier
1585            - graphicsmagick 1.3.5-6 (embed)
1586            - graphviz 2.8-3 (embed)
1587            NOTE: The etch version of graphviz was the earliest version checked, might be fixed earlier
1588            - guile-1.6 1.6.8-7 (embed)
1589            - hamlib <unfixed> (embed)
1590            - hercules <unfixed> (embed)
1591            - jags 1.0.4-3 (embed; bug #560864)
1592            - kdelibs <unfixed> (embed)
1593            - libannodex <removed> (embed)
1594            - libextractor <unfixed> (embed)
1595            - libmcrypt <not-affected> (libtool source present but not included in any of the binary packages)
1596            - libtunepimp <unfixed> (embed)
1597            - mp4h <unfixed> (embed)
1598            - naim <unfixed> (embed)
1599            - parser-mysql <unfixed> (embed)
1600            - pinball 0.3.1-11 (embed)
1601            - redland <unfixed> (embed)
1602            - siproxd <unfixed> (embed)
1603            - ski <unfixed> (embed)
1604            - synfig <unfixed> (embed)
1605            - unixodbc 2.2.4-5 (embed)
1606            - xmlsec1 <not-affected> (Doesn't enable dynamic loading of crypto modules)
1607            - clamav 0.95+dfsg-1 (embed)
1608            - imagemagick 6:6.2.3.1-1 (embed)
1609            - hypre 2.4.0b-5 (embed)
1610            - lam <unfixed> (embed)
1611            - openmpi <unfixable> (embed; bug #559386)
1612            - parser <unfixed> (embed)
1613            - pdsh 2.18-5 (embed; bug #560892)
1614            - sbnc 1.2-8 (embed)
1615            - sdcc <unfixed> (embed)
1616            - wml <unfixed> (embed)
1617            - proftpd-dfsg <unfixed> (embed; bug #561748)
1618            - babel 1.4.0.dfsg-5 (embed)
1619            - libprelude 0.9.14-2 (embed)
1620            - heartbeat 2.1.4-7 (embed)
1621            NOTE: From Squeeze onwards the system copy of ltdl is used, use the current version from Squeeze,
1622            NOTE: might've been fixed earlier
1623            - gcc-* <unknown> (embed)
1624    
1625    ocamlgsl
1626            - orpie 1.5.1-7.1 (embed; bug #550058)
1627    
1628    xdotool
1629            - keynav <unfixed> (embed; bug #560103)
1630    
1631    bulletphysics (not packaged; http://www.bulletphysics.org/)
1632            - supertuxkart <unfixed> (embed)
1633            - blender <unfixed> (embed)
1634    
1635  gv:  ghostscript
1636  evince (ps/ tree from gv 3.5.8)          - gs-gpl <removed> (old-version)
 evince-gtk (not packaged in Debian)  
   
 libXbae:  
 libpawlib2-lesstif package (from Cernlib)  
   
 libXaw:  
 libpawlib2-lesstif package (from Cernlib)  
1637    
1638  (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  icedove
1639            - thunderbird <removed> (old-version)
1640    
1641  libgd2:  sizzlejs (not packaged in Debian, http://sizzlejs.com/)
1642  graphviz (lib/gd seems to be 2.0.33)          - jquery <unfixed> (embed)
1643    
1644  rar:  sed
1645  unrar-nonfree          - ssed <unfixed> (fork)
1646    
1647  unrar-free: (maybe this code is derived from the original rar, too?)  phpatomlib (http://code.google.com/p/phpatomlib)
1648  clamav (seems to be disabled in default config)          - wordpress <unfixed> (embed)
1649    
1650  mplayer (DirectMedia Object loader):  Services_JSON (http://pear.php.net/package/Services_JSON)
1651  xine-lib (src/libw32dll/)          - wordpress <unfixed> (embed)
 vlc (modules/codec/dmo/)  
1652    
1653  libwpd (WordPerfect converter):  phpass (http://www.openwall.com/phpass/)
1654  openoffice.org          - gallery2 <unfixed> (embed)
1655            - wordpress <unfixed> (embed)
1656            - typo3-src <unfixed> (fork)
1657            NOTE: file refers to drupal, maybe there's a copy somewhere there
1658            NOTE: a copyright owner search didn't match anything
1659            - libauthen-passphrase-perl <unfixable> (fork)
1660            NOTE: perl implementation of phpass
1661    
1662  fsplib (http://sourceforge.net/projects/fsp/):  squirrelmail
1663  gftp (lib/fsplib version 0.3)          - wordpress <unfixed> (embed)
1664            NOTE: class-pop3.php
1665    
1666  librpcsecgss:  ezSQL (http://www.woyano.com/jv/ezsql)
1667  krb5          - wordpress <unfixable> (fork)
1668            NOTE: wp-db.php
1669    
1670  jasper:  Diff.php (Clay Loveless' version/killersoft.com)
1671  ghostscript          - php-versioncontrol-svn <unfixed>
 gs-gpl  
1672    
1673  libidn:  libm
1674  monotone          - spring <unfixed> (embed)
1675            NOTE: embedded by embedded copy of streflop
1676    
1677  liblua:  streflop
1678  monotone          - spring <unfixed> (embed)
1679    
1680  libbotan:  minizip
1681  montone          - spring <unfixed> (embed)
1682    
1683  NetXX:  oscpack
1684  monotone          - spring <unfixed> (embed)
1685    
1686  libgc:  hpiutil2
1687  mono          - spring <unfixed> (embed)
1688    
 lzma:  
1689  p7zip  p7zip
1690            - spring <unfixed> (embed)
1691    
1692  lzo:  pythonqt (doesn't seem to be python-qtN, unknown source)
1693  grub2          - fontmatrix <unfixed> (embed)
1694            - elmerfem <unfixed> (embed)
1695  pax code:  
1696  tar  iepngfix (not packaged in Debian; http://www.twinhelix.com/css/iepngfix/)
1697  cpio          - docvert <unfixed> (embed)
1698            - jifty <unfixed> (embed)
1699            - kdenetwork <unfixed> (embed)
1700            - mediatomb <unfixed> (embed)
1701            - plastex <unfixed> (embed)
1702            - plone3 <removed> (embed)
1703            - python-chaco <unfixed> (embed)
1704            - python-docutils <unfixed> (embed)
1705            - s5 <unfixed> (embed)
1706            - zope2.10 <unfixed> (embed)
1707            - zope2.11 <removed> (embed)
1708            - cython <not-affcted> (embed)
1709            NOTE: part of documentation, which is not installed into the binary package
1710    
1711    python-docutils
1712            - zope2.10 <unfixed> (embed)
1713            - zope2.11 <removed> (embed)
1714    
1715  t1lib:  tesseract
1716  tetex-bin (links to system t1lib since 2.0.2)          - ocropus <unfixed> (static)
 texlive-bin (links to system t1lib)  
1717    
1718    antlr
1719            - kdevelop <unfixed> (embed)

Legend:
Removed from v.7700  
changed lines
  Added in v.13833

  ViewVC Help
Powered by ViewVC 1.1.5