/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 7700 by jmm-guest, Sun Dec 23 10:58:57 2007 UTC revision 15516 by jmm-guest, Sun Oct 24 10:51:01 2010 UTC
# Line 1  Line 1 
1  Embedded code copies  Embedded code copies
2  ====================  ====================
3    
4  This file collects cases, where a source package embeds code from  This file collects source packages that embed code from other projects.
5  other projects which is considered bad for fixing security flaws  This is considered bad for fixing security flaws because the fix needs
6  because the fix needs to be applied in multiple source packages.  to be applied in multiple source packages.
7    
8  Format:  Format:
9  <srcpkg> (<optional comment about srcpkg>)  <srcpkg> (<optional comment about srcpkg>)
10          - <embedding srcpkg> <status> (<sort>; bug #<number>)          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11          NOTE: optional comments about the linkage of the embedding srcpkg          NOTE: optional comments about the linkage of the embedding srcpkg
12    
13  status: version number fixing the embedded copy, <unfixed>, <removed> or <unknown> if the version number can not be determined  status: version number fixing the embedded copy
14  sort: static/dynamic          <unfixed> if the issue is not yet fixed
15            <removed> if the package was removed from the archive
16  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)          <itp> if the package is in the process of being packaged
17          - gpdf <removed>          <not-affected> if the package does not use the embedded copy
18          [sarge] - gpdf <unfixed>          <unknown> if the version number can not be determined
19          NOTE: has been replaced by evince in etch          <unfixable> for unavoidable cases (e.g., forks that add real value)
20    sort: static (linking statically against a lib)
21          embed (embeds a copy of the library into another source package)
22          modified-embed (embeds a code copy that differs from upstream code)
23          fork (a full-blown fork of another source package)
24          old-version (an older version of essentially the same code)
25    
26    The srcpkg might be some string to identify the code if there is no
27    specific source package.
28    
29    Everything up to the next line is ignored.
30    ---BEGIN
31    poppler
32          - pdftohtml <unknown>          - pdftohtml <unknown>
33          [sarge] - pdftohtml <unfixed>          [sarge] - pdftohtml <unfixed>
34          [etch] - pdftohtml <unfixed>          [etch] - pdftohtml <unfixed>
35          NOTE: has been replaced by poppler-utils          NOTE: has been replaced by poppler-utils
36          - kdegraphics <unfixed> (static; bug #436164)          - kdegraphics 4:4.2.2-1 (embed; bug #436164)
37          NOTE: the kpdf replacement in KDE 4 is using poppler          - texlive-base 3.0-12 (embed)
38          - tetex-bin 3.0-12 (dynamic)          - texlive-bin 2007-1 (embed)
39          NOTE: links to poppler          - koffice 1:2.0.0-1 (embed; bug #436163)
40          - texlive-bin <unknown> (dynamic)          - libextractor 0.5.12-1 (embed)
41          NOTE: links to poppler          NOTE: libextractor is using its own pdf decoder now
42          - koffice <unfixed> (static; bug #436163)          - ipe <unfixed> (embed)
         - libextractor 0.5.12-1 (static)  
         NOTE: libextractor is using its own pdf decoder  
         - libextractor 0.5.12-1 (dynamic)  
         NOTE: links to poppler  
         - pdfkit.framework 0.8-4 (dynamic)  
         NOTE: links to poppler  
         - ipe <unfixed> (static)  
43          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
44          - ruby-gnome2 <unknown> (dynamic)          - ruby-gnome2 <unknown> (embed)
45          NOTE: copy only present in source but links to poppler          - pdfedit <unfixed> (embed; bug #510794)
46            - swftools <removed> (embed; bug #551293)
47            - xpdf 3.02-9 (fork)
48    
49    pdksh (no longer developed since 1999)
50            - mksh <unfixable> (fork)
51            - posh <unfixable> (fork)
52    
53    ppmd
54            - libcomplearn-mod-ppmd <unfixed> (fork)
55            NOTE: discussion in #458152
56    
57    libevent
58            - transmission 1.71-1 (embed; bug #529372)
59            - chromium-browser 5.0.375.29~r46008-1
60            - dnsproxy <unknown> (embed)
61    
62    lrmi
63            - read-edid 2.0.0-1 (embed; bug #495131)
64            - s3switch <unfixed> (embed)
65            - xresprobe <unfixed> (embed)
66            - zhcon <unfixed> (embed)
67    
68    php-htmlpurifier
69            - mahara 1.2.5-1 (embed)
70            - knowledgeroot 0.9.9.5-5 (embed)
71            - moodle <unfixed> (embed)
72    
73    peercast
74            - gnome-peercast <removed> (embed)
75            [etch] - gnome-peercast <unfixed> (embed)
76    
77    silc-toolkit
78            - silc-client 1.1~beta6-1 (embed)
79    
80    icclib
81            - ghostscript <unfixed> (embed)
82            - argyll <unfixed> (embed)
83    
84    libusb
85            - argyll <unfixed> (embed)
86    
87    dietlibc
88            - ccontrol 0.9.1+20071204-1 (static)
89            - mksh <unfixable> (static)
90            NOTE: /bin/mksh-static only, and only on some arches (others use eglibc)
91    
92    libmikmod
93            - sdl-mixer1.2 <unfixed> (embed)
94            TODO: report bug
95    
96    libiax
97            - iaxmodem <unfixable> (embed; bug #548885)
98    
99    spandsp
100            - iaxmodem <unfixable> (embed; bug #548885)
101    
102    python-paramiko
103            - fabric 0.9.0-2 (embed; bug #561398)
104    
105    zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
106            - dpkg 1.15.6 (static)
107            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
108            - rsync <unfixed> (embed)
109            - cherokee <unfixed> (embed)
110            NOTE: somehow derived code base
111            - mono <unfixed> (embed)
112            TODO: check mozilla
113            - Linux kernels <unfixed> (embed)
114            - pvpgn 1.7.8-2 (embed)
115            - mrtg 2.12.2-1 (embed)
116            - rpm <unknown> (embed)
117            NOTE: pinged anibal since when rpm was fixed
118            - tuxcmd-modules <unfixed> (embed)
119            - zsync <unfixed>
120            - tra <unfixed>
121            - sash <unfixed>
122            - nsis <unfixed>
123            - pyfits 1:2.3.1-1
124            - mseide-msegui <unfixed>
125            NOTE: mseide
126            - mirrordir <unfixed>
127            - poco <unfixed>
128            - klibc <unfixed>
129            - emboss <unfixed>
130            - ghostscript <unfixed>
131            - freeimage <unfixed>
132            - clamav <unfixed> (fork)
133            NOTE: from the changelog: "libclamav6 does indeed duplicate parts of the zlib code, but there is not way around that"
134            - tuxonice-userui <unfixed> (static)
135            - plt-scheme <unfixed>
136            - perl <unfixed>
137            - paraview <unfixed>
138            - velvet 0.7.56~nozlibcopy-1
139            - gcvs <unfixed>
140            - dump <unfixed>
141            - aide <unfixed> (static)
142            - dar <unfixed> (static)
143            - avfs <unfixed>
144            - fpc <unfixed>
145            - winff <unfixed>
146            NOTE: inherited from fpc, see #472304
147            - lazarus <unfixed>
148            NOTE: inherited from fpc, see #472304
149            - erlang <unfixed> (embed)
150            - gamera 3.2.3-1 (embed)
151            - python2.4 <unfixed> (embed; bug #553403)
152            - python2.5 <unfixed> (embed; bug #553403)
153            - texlive-bin <unknown> (embed)
154    
155    dulwich
156            - hg-git 0.1.0-1 (embed; bug #541996)
157    
158    libvigraimpex
159            - hugin <unfixed> (embed; bug #542259)
160            - enblend-enfuse <unfixed> (embed; bug #542258)
161            - gamera 3.2.3-1 (embed)
162    
163    libbz2
164            - dpkg 1.15.6 (static)
165            - amd64-libs <unfixed> (static)
166            NOTE: let's call it "static"
167            - dar <unfixed> (static)
168            - dump <unfixed> (static)
169            - unalz 0.64-1 (embed)
170            NOTE: has code, by the maint, to use the system version but links against the internal copy
171            - clamav <unfixed> (embed)
172            NOTE: libclamav/nsis/bzlib*
173            - pristine-tar <unfixable> (modified-embed)
174            NOTE: compression code only, not uncompression
175            - r-base-core-ra 1.2.8 (static)
176            - r-base-core 2.11.1 (static)
177            NOTE: links dynamically in squeeze, statically in lenny
178            - rpm <unfixed> (static)
179            NOTE: lsb-rpm package is statically linked, normal rpm links dynamically
180    
181    libyahoo2
182            - centerim <unfixed> (embed; bug #559783)
183    
184    libmsn
185            - centerim <unfixed> (embed; bug #559783)
186    
187    libgadu
188            - centerim <unfixed> (embed; bug #559783)
189            - pidgin <not-affected> (links dynamically since initial release; fixed in gaim)
190            - gaim 1:2.0.0+beta3-3 (embed; bug #360280)
191            - kdenetwork 4:3.3.2-5 (embed)
192            NOTE: from kdenetwork: kopete
193            - ekg 1:1.8~rc0-1 (embed)
194            - kadu 0.6.0.2-3 (embed; bug #504430)
195            - gadu <itp> (embed)
196    
197    xmlrpc (which package is the "origin" of this code?)
198            - drupal <unfixed> (embed)
199            - phpgroupware <unfixed> (embed)
200            - egroupware <unfixed> (embed)
201            - phpwiki <unfixed> (embed)
202            - php4 <removed> (embed)
203            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
204    
205    shtool (affects build-time only)
206            - mysql-ocaml <unfixed> (embed)
207            - php4 <removed> (embed)
208            - php5 <unfixed> (embed)
209    
210  silc-toolkit:  xulrunner
211  silc-client (uses libsilc and libsilcclient)          - iceape <unfixed> (embed; bug #561749)
212            - iceweasel 2.0.0.19 (embed)
213            - icedove <unfixed> (embed; bug #561750)
214            - kompozer <unfixed> (embed; bug #532168)
215            - galeon 2.0.2-4 (embed)
216            - epiphany-browser 2.14.3-8 (embed)
217            - conkeror 0.9~git080629-2 (embed)
218            - kazehakase 0.4.2-1 (embed)
219    
220    xli
221            - xloadimage <unfixed> (embed)
222    
223    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
224            - openmotif <unfixed> (embed)
225    
226    libxpm
227            - lesstif2 <unfixed> (embed; bug #575750)
228    
229    kerberized apps with BSD origin
230            - krb4 <removed> (embed)
231            - krb5 <unfixed> (embed)
232            - heimdal <unfixed> (embed)
233    
234    grip (which pkg is the origin?)
235            - libcdaudio <unfixed>
236            - grip <unfixed>
237            - gnome-vfs <unfixed>
238            TODO: check vfs2 as well
239    
240    fudforum
241            [etch] - phpgroupware <unfixed> (embed)
242            NOTE: phpgroupware-fudforum
243            [sarge] - egroupware-fudforum <removed> (embed)
244    
245    libbsd
246            - rdate 1:1.2-3 (embed)
247            - atheme-services <unfixed>
248            - libbsd-arc4random-perl <not-affected> (modified-embed)
249            NOTE: code not used, it links dynamically against libbsd instead
250            - isakmpd <unfixed>
251            - bsdgames <unfixed> (embed)
252            - bsd-mailx <unfixed> (embed)
253            - netcat-openbsd <unfixed> (embed; bug #550611)
254            - openssh <unfixed> (embed)
255            - unworkable <unfixed> (embed)
256            - mksh <unfixed> (modified-embed)
257            NOTE: strlcpy(), only used in /bin/mksh-static on eglibc arches
258            NOTE: FIXME, we should only have one entry: - mksh <not-affected> (modified-embed)
259            NOTE: strlcpy() on dietlibc arches; {g,s}etmode(); both unused
260    
261    cvs
262            - gcvs <unfixed> (embed)
263            NOTE: see cvsunix/src in tarball
264    
265    pcre3
266            - php4 <removed> (embed)
267            - analog 2:5.23-0woody1 (embed)
268            - goffice <unfixed> (embed)
269            NOTE: libgoffice-*
270            - vfu 4.06-4.1 (embed; bug #450754)
271            - tf5 5.0beta7-1 (embed)
272            - monotone 0.43-1 (embed)
273            NOTE: this only affects versions >= 0.37
274            - glib2.0 2.15.2-1 (embed)
275            - apache2 2.0.53-4 (embed)
276            - exim4 4.10-0.srh20.12 (embed)
277            - yacas <unfixed> (embed)
278            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
279            - gtamsanalyzer.app 0.42-5 (embed)
280            - tin 980117-1 (embed)
281            - kazehakase 0.5.2-1
282            - webkit 1.0.1-1 (embed)
283            - qt4-x11 <unfixed> (embed)
284            NOTE: embedded via webkit copy
285            - erlang <unfixed> (embed)
286            - ssed <unfixed> (embed)
287            - ircd-hybrid <unfixed> (static)
288            - emboss <unfixd>
289            - cherokee <unfixed> (embed)
290            - oftc-hybrid 1.6.9.dfsg-1 (embed)
291            - ratbox-services <unfixed> (embed)
292            - squeak-vm <unfixed> (embed)
293            - tinymux <unfixed> (embed)
294    
295    tiff
296            - wxwindows2.4 2.2.1 (embed)
297            - gamera 3.2.3-1 (embed)
298            - freeimage <unfixed> (embed)
299            - libtk-img <unfixed> (embed)
300            NOTE: there are two copies, one under tiff/ other under libtiff/
301            - gdal <unfixed>
302    
303    uudeview
304            - libconvert-uulib-perl <unfixed> (embed)
305            - pan <unfixed> (embed)
306    
307    sqlite (not affected by security vulnerabilities so far)
308            - amarok <unfixed> (embed)
309            - monotone 0.43-1 (embed)
310            - iceweasel <unfixed> (embed)
311            - heimdal <unfixed> (embed; bug #559616)
312    
313    util-linux/mount
314            - loop-aes-utils <unfixed> (embed)
315            NOTE: contains code from util-linux' mount in the mount-aes-udeb
316    
317    sylpheed
318            - sylpheed-claws <unfixed> (fork)
319    
320    phpsysinfo
321            - egroupware <unfixed> (embed)
322            - phpgroupware <unfixed> (embed)
323    
324    phpldapadmin
325            [sarge] - egroupware <unfixed> (embed)
326            NOTE: removed from egroupware after sarge
327    
328    chmlib
329            - kchmviewer <unknown> (embed)
330    
331    ffmpeg (libavcodec/libavformat)
332            - mplayer 1.0~rc2-14 (embed; bug #395252)
333            - kino 1.0.0-1
334            - vlc <not-affected> (Links dynamically since initial release)
335            - smilutils 0.3.0-10
336            NOTE: smilutils likely fixed earlier, marking Etch's version as fixed
337            - motion 3.1.19-1
338            - gstreamer0.10-ffmpeg 0.10.3-2
339            - xmovie <removed> (static)
340            TODO: gimp-gap (potentially using ffmpeg code as well)
341            - avifile 1:0.7.48~20090503.ds-1 (embed; bug #538750)
342            - audacity 1.3.7-2 (embed; bug #512278)
343            - chromium-browser <unfixed> (fork)
344    
345    faad2
346            - mplayer 1.0~rc2-20 (embed)
347            - avifile <unfixed> (embed; bug #538750)
348            - ffmpeg-debian <removed> (embed)
349    
350    libmad (MPEG decoding lib)
351            - xine-lib <unfixed> (embed)
352            - avifile 1:0.7.48~20090503.ds-1 (embed) [./plugins/libmad/*]
353            TODO: check ocaml-mad, madplay, pymad, xmms-mad, xmms2
354    
355  dietlibc:  libdts
356  ccontrol (linked statically until 0.9.1+20071204-1, affects Etch only)          - xine-lib <unfixed> (embed)
357    
358  libiax:  flac
359  iaxmodem          - xine-lib <unfixed> (embed)
   
 zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  
 dpkg  
 rsync (somehow derived code base)  
 mono  
 mozilla(?)  
 Linux kernels  
 pvpgn (links dynamically since 1.7.8-2)  
 mrtg (links dynamically since 2.12.2-1)  
 rpm  
   
 libbz2:  
 dpkg (statically linked)  
   
 libgadu/ekg:  
 centericq  
 gaim  
 pigdin (links dynamically against libgadu)  
 kopete (ships the code, but links dynamically in the Debian package)  
 kadu (not packaged in Debian)  
 GNU gadu (not yet packaged in Debian)  
   
 xmlrpc: (which package is the "origin" of this code?)  
 drupal  
 phpgroupware  
 egroupware  
 phpwiki  
 php4 (php-pear, IIRC this was reorganized some weeks ago?)  
   
 shtool: (affects build-time only)  
 mysql-ocaml  
 php4  
   
 mozilla:  
 mozilla-firefox  
 mozilla-thunderbird  
 firefox (to be removed)  
 thunderbird (to be removed)  
 iceweasel  
 iceape  
 icedove  
 xulrunner  
 nvu (no longer in Debian)  
360    
361  xli:  liba52
362  xloadimage          - a52dec <unfixed> (embed)
363            - xine-lib <unfixed> (embed)
364    
365    mpeg2dec (libmpeg2)
366            - xine-lib <unfixed> (embed)
367    
368    libmpeg3
369            - squeak-vm <unfixed> (embed)
370    
371    libntlm
372            - wget <unfixed> (fork; bug #550436)
373            - curl <unfixed> (fork; bug #550437)
374            - cntlm <unfixed> (fork; bug #550438)
375    
376    uw-imap
377            - pine <unfixed> (embed)
378            - alpine <unfixed> (embed)
379    
380    imagemagick
381            - graphicsmagick <unfixed> (fork)
382    
383    python-urlgrabber
384            - mercurial <unfixed> (embed; bug #531062)
385            - w3af <unfixed> (embed; bug #555372)
386            [experimental] - harvestman <unfixed> (embed; bug #555373)
387    
388    beautifulsoup
389            - python-mechanize <unfixed> (embed; bug #555349)
390            - zope2.11 <removed> (embed; bug #555350)
391            - twill <unknown> (embed)
392    
393    halibut
394            - nsis <unfixed> (fork)
395    
396    libghttp
397            - hotway <unfixed> (embed)
398    
399    libsndfile
400            - ardour 1:2.7.1-1 (embed)
401    
402    glibmm2.4
403            - ardour 1:2.7.1-1 (embed)
404    
405    libgnomecanvasmm2.6
406            - ardour 1:2.7.1-1 (embed)
407    
408    libsigc++-2.0
409            - ardour 1:2.7.1-1 (embed)
410    
411    soundtouch
412            - ardour 1:2.7.1-1 (embed)
413    
414    libmms
415            - xine-lib <unfixed> (embed)
416            - mimms <unfixed> (embed)
417    
418    fckeditor
419            - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
420            - moin 1.8.2-2 (embed; bug #452599)
421            - karrigell <removed> (embed; bug #452598)
422            - gforge 4.6.99+svn6225-1 (embed)
423            - request-tracker3.8 <unfixed> (embed)
424            - otrs2 <unfixed> (embed)
425    
426    ipatlas (not packaged in Debian)
427            - moodle <unfixed> (embed; bug #507185)
428    
429    libphp-phpmailer
430            - moodle <unfixed> (embed; bug #507185)
431            - mahara <unfixed> (embed)
432            - symfony <unfixed> (embed; bug #566778)
433            [etch] - phpgroupware <unfixed> (embed)
434            NOTE: phpgroupware-felamimail is only in etch
435            - egroupware <unfixed> (embed; bug #504283)
436            - glpi <unfixed>
437    
438    htmlArea (not packaged in Debian)
439            - moodle <unfixed> (embed)
440    
441    giflib
442            - wine <unfixed> (embed; bug #466181)
443    
444    bennu (not packaged in Debian, http://bennu.sourceforge.net)
445            - moodle <unfixed> (embed)
446    
447    smarty
448            - moodle 1.8.2-2 (embed; bug #471158)
449            - gallery2 2.2.5-2 (embed; bug #471160)
450            - mahara 0.9.2-2 (embed; bug #471201)
451            - gosa 2.4beta1-1 (embed; bug #471200)
452    
453  lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)  TinyMCE
454  openmotif          - wordpress 2.5.1-3 (embed; bug #478257)
455  xfree86/xorg (in libxpm)          - moodle <unfixed> (embed; bug #507185)
456            - knowledgeroot <unfixed> (embed)
457  kerberized apps with BSD origin:          - joomla <itp> (bug #326398)
458  krb4          - mahara 1.2.6-1 (embed; #597752)
459  krb5  
460  heimdal  scintilla (upstream provides static lib, rejected shared lib http://sf.net/support/tracker.php?aid=2488121)
461            - scite <unfixed> (embed)
462  grip: (which pkg is the origin?)          - qscintilla <unfixed> (embed)
463  libcdaudio          - qscintilla2 <unfixed> (embed)
464  grip          - geany <unfixed> (fork)
465  gnome-vfs (vfs2 as well?)          - anjuta <unfixed> (embed)
466    
467  fudforum:  libphp-adodb
468  phpgroupware-fudforum          - moodle <unfixed> (embed; bug #507185)
469  egroupware-fudforum (removed from egroupware after sarge)          NOTE: also AdoDB-XML Schema
470            - gallery2 <unfixed> (embed)
471  cvs:          - phppgadmin <unfixed> (embed)
472  gcvs (at least an additional script is included, check if there's more)          - egroupware <unfixed> (embed)
473            - phpwiki <unfixed> (embed)
474  pcre:          - torrentflux 2.0beta1-2 (embed)
475  all pythons          - ipplan <unfixed> (embed)
476  php4 (src included, but Debian package links dynamically)          - typo3-src <unfixed> (embed)
477  analog (src included, but Debian package links dynamically)          - cacti <unknown> (embed)
478  libgoffice-1          [sarge] - cacti <unfixed> (embed)
479  vfu (removed linking against embedded copy in 4.06-4.1; #450754)          NOTE: dependency exists, but internal version is used
480  tf5 (since 5.0beta7 the Debian package links dynamically)          - gforge 4.7~rc2-6 (embed)
481  monotone (including this starting from 0.37)          - mahara <unfixed> (embed)
482  glib (2.14 series for gregex support, only for udeb, regular packag links dynamic)  
483  apache2 (since 2.0.53-4 uses 040_link_external_pcre patch)  gzip
484  exim4 (since 4.10-0.srh20.12 uses 36_pcre patch to use external pcre)          - linux-2.6 <unfixed> (embed) [lib/inflate.c]
485  yacas (<= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway)          - klibc <unfixed> (embed)
486  gtamsanalyzer.app (links dynamically since 0.42-5)          NOTE: based on linux-kernel gzip code
487            - busybox <unfixed> (embed)
488  tiff:          - pristine-tar <unfixed> (modified-embed)
489  wxpythongtk (check, which debian pkg this is in)          NOTE: compression code only, not uncompression
490  older kdegraphics/kpdf releases < 3.3 embedded a copy          - ncompress <unfixed> (old-version)
491    
492  uudeview:  neon
493  libconvert-uulib-perl          - cadaver 0.22.3+debian-1 (embed; bug #188381)
494            - gnome-vfs2 <unfixed> (embed; bug #395874)
495  sqlite: (not affected by security vulnerabilities so far)          [etch] - litmus <unfixed> (embed; #395875)
496  amarok          - litmus <removed> (embed; #395875)
497  monotone          [sarge] - screem <unfixed> (embed)
498  iceweasel          - sitecopy 1:0.16.0-1 (embed; bug #395876)
499            [etch] - tla <unfixed> (embed; bug #395877)
500  util-linux/mount:          [sarge] - tla <unfixed> (embed; bug #395877)
501  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb  
502    libmodplug
503  webmin:          - gst-plugins-bad0.10 0.10.10.2-1 (embed)
504  usermin (only in sarge)  
505    libvncserver
506  sylpheed:          - vino <unfixed> (embed)
507  sylpheed-claws  
508    putty
509  phpsysinfo:          - filezilla <unfixed> (embed)
510  egroupware  
511  phpgroupware  tinyxml (not packaged in Debian; itp bug #531968)
512            - filezilla <unfixed>
513  phpldapadmin:          - crystalspace <unfixed> (embed)
514  egroupware (removed from egroupware after sarge)          - libwfut <unfixed> (embed)
515            - rarian <unfixed> (embed)
516  chmlib:          - bulletml <unfixed> (embed)
517  kchmviewer (ships the code but links dynamically)          - pokerth <unfixed> (embed)
518            - qutecom <unfixed> (embed)
519  libavcodec/libavformat (source: ffmpeg):          - sofa-framework <unfixed> (embed)
520  mplayer (#395252)          - yate <unfixed> (embed)
521  xvidcap          - antigrav <unfixed> (embed)
522  kino (links statically, does not include code)          - balder2d <unfixed> (embed)
523  vlc (links statically, does not include code)          - cal3d <unfixed> (embed)
524  smilutils (links statically, does not include code)          - criticalmass <unfixed> (embed)
525  motion (links statically, does not include code)          - ember <unfixed> (embed)
526  gst-ffmpeg          - epiphany <unfixed> (embed)
527  gstreamer0.10-ffmpeg          - gambit <unfixed> (embed)
528  xmovie          - noiz2sa <unfixed> (embed)
529            - ogre <unfixed> (embed)
530            - opencity <unfixed> (embed)
531            - openmovieeditor <unfixed> (embed)
532            - pouetchess <unfixed> (embed)
533            - tecnoballz <unfixed> (embed)
534            - trigger-rally <unfixed> (embed)
535            - xmoto <unfixed> (embed)
536            - mapnik <unknown> (embed)
537            NOTE: uses a different XML parser by default
538            - rrootage 0.23a-6 <embed>
539            NOTE: links to libbulltetml
540            - boson <unknown> (embed)
541            NOTE: the embedded code is unused
542    
543    gv
544            - evince <unfixed> (embed)
545            NOTE: ps/ tree from gv 3.5.8
546            NOTE: evince-gtk is affected (a component of evince source package)
547    
548    libXbae
549            - paw <unfixed> (embed)
550    
551    libgtkhtml
552            - claws-mail-extra-plugins <unfixed> (fork)
553    
554    libXaw
555            - paw <unfixed> (embed)
556            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
557    
558    libgd2
559            - graphviz <unfixed> (embed)
560            NOTE: lib/gd seems to be 2.0.33
561            - wml 2.0.11ds2-1 (embed)
562            - libwmf <unfixed> (embed)
563            NOTE: derived from gd 1.6.3
564            - texlive-bin 2009-1 (embed)
565    
566    rar
567            - unrar-nonfree <unfixed> (embed)
568    
569    unrar-free (maybe this code is derived from the original rar, too?)
570            - clamav <unfixed> (embed)
571            NOTE: seems to be disabled in default config
572    
573    mplayer (DirectMedia Object loader)
574            - xine-lib <unfixed> (embed)
575            NOTE: src/libw32dll/
576            - vlc <unfixed> (embed)
577            NOTE: modules/codec/dmo/
578            - mplayer 1.0~rc2-20 (embed)
579    
580    libwpd (WordPerfect converter)
581            - openoffice.org <unfixed> (embed)
582    
583    fsplib (http://sourceforge.net/projects/fsp/)
584            - gftp <unfixed> (embed)
585            NOTE: lib/fsplib version 0.3
586    
587    sprng
588            - tree-puzzle <unfixed> (embed)
589    
590    librpcsecgss
591            - krb5 <unfixed> (embed)
592    
593    jasper
594            - ghostscript 8.64~dfsg-2 (embed)
595    
596    libiris
597            - psi <unfixed> (embed)
598            - kdenetwork <unfixed> (embed)
599            NOTE: kopete embeds libiris but links dynamically to libidn
600            - kdegames <unfixed> (embed)
601            NOTE: ksirk/kde4
602    
603    libidn
604            - monotone 0.43-1 (embed)
605            - psi <unfixed> (embed)
606            NOTE: psi embeds libiris which embeds libidn
607            - kdegames <unfixed> (embed)
608            NOTE: kdegames/kde4 embeds libiris which embeds libidn
609    
610    lua5.1
611            - monotone 0.43-1 (embed)
612            - nmap 5.00-1 (embed; bug #527997)
613            [lenny] - nmap <unfixed> (embed; bug #527997)
614            - ocropus <unfixed> (embed)
615            - enigma <unfixed> (embed)
616            NOTE: requires lua built with C++
617            - freeciv <unfixed> (embed)
618            - spring <unfixed> (embed)
619    
620    libbotan
621            - monotone 0.43-1 (embed)
622    
623    NetXX
624            - monotone 0.43-1 (embed)
625    
626    libgc
627            - mono <unfixed> (embed)
628    
629    lzma
630            - p7zip <unfixed> (embed)
631            - xz-utils <unfixed> (fork)
632            - r-base <unfixed> (embed)
633            NOTE: lzma support not yet in lenny or in r-base-core-ra 1.2.8
634    
635    lzo
636            - grub2 <unfixed> (embed)
637    
638    yassl
639            - mysql-dfsg-5.0 <unfixed> (embed)
640            - mysql-5.1 <unfixed> (embed)
641    
642    pax code
643            - tar <unfixed> (embed)
644            - cpio <unfixed> (embed)
645    
646    t1lib
647            - tetex-bin 2.0.2-1 (embed)
648            - texlive-bin <unknown> (embed)
649            - grace 5.1.14-2 (embed)
650            NOTE: Might be fixed even earlier
651    
652    guichan
653            - boswars <unfixed> (embed)
654            NOTE: maintainer notified us, working on it
655    
656    tolua
657            - boswars <unfixed> (embed)
658            NOTE: maintainer notified us, working on it
659            NOTE: actually tolua++
660            - ocropus <unfixed> (embed)
661            NOTE: actually tolua++
662            - freeciv <unfixed> (embed)
663            NOTE: actually tolua++
664            - enigma <unfixed> (embed)
665    
666  mad MPEG decoding lib:  asio-dev
667  mad          - luxrender <removed> (embed)
 xine-lib  
668    
 libdts:  
 libdts  
669  xine-lib  xine-lib
670            - vlc <unfixed> (embed)
671            NOTE: only parts included in modules/access/rtsp
672    
673  flac:  netpbm
674  flac          - tcl8.3 <unfixed> (embed)
675  xine-lib          - tcl8.4 <unfixed> (embed)
676            - tcl8.5 <unfixed> (embed)
677            NOTE: generic/tkImgGIF.c
678    
679    tk8.5
680            - tk8.0 <removed> (old-version)
681            - tk8.3 <unfixed> (old-version)
682            - tk8.4 <unfixed> (old-version)
683            - perl-tk <unfixable> (fork)
684    
685    samba
686            - mc 2:4.6.2~git20080311-1 (embed)
687            NOTE: maintainer is aware of this, currently searching a solution
688    
689    plib1.8.4c2
690            - boson <unfixed> (fork)
691            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
692    
693    fribidi
694            - quesoglc 0.7.2-2 (embed)
695    
696    glew
697            - quesoglc <unfixed> (embed; bug #489341)
698            NOTE: waiting on GLEW_MX version of glew (see bug #474488)
699            - trigger 0.5.2.1-2 (embed)
700            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
701            - trigger-rally 0.5.2.1-2 (embed)
702            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
703            - chromium-browser 5.0.375.70~r48679-2
704    
705    minorGems (pabs contacted upstream about shared lib, he considers minorGems an 'ever-evolving collection of reusable code fragments' for his own use)
706            - transcend <unfixed> (embed)
707            - cultivation <unfixed> (embed)
708            - passage <unfixed> (embed)
709            - gravitation <unfixed> (embed)
710    
711  liba52:  tar
712  a52dec          - libarchive <unfixed> (embed)
713  xine-lib          NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
714    
715  libmpeg2:  cpio
716  mpeg2dec          - libarchive <unfixed> (embed)
717  xine-lib          NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
718    
719  curl:  kde4libs
720  wget (code for NTLM authentication)          - kdelibs <unfixable> (old-version)
721    
722  TODO evaluate:  webkit
723  gimp-gap (potentially using ffmpeg code as well)          - qt4-x11 <unfixed> (embed; bug #479851)
724            [etch] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
725            - kde4libs <unfixable> (fork)
726            NOTE: kde4lib's khtml and webkit were forked from khtml (this tracking, which seems
727            NOTE: reversed genesis-wise, is used because of so much other stuff in kde4libs)
728            - chromium-browser <unfixed> (fork)
729    
730    ftgl
731            - blender 2.46+dfsg-1 (embed)
732    
733    wv
734            - abiword <unfixed>
735    
736    qemu
737            - kvm <removed> (embed; bug #543159)
738            - qemu-kvm <unfixed> (embed; bug #560853)
739            NOTE: kvm superceded by qemu-kvm, which is just user interface (no modules)
740            - xen-3 3.4.2-2 (embed; bug #560856)
741            - xen-unstable <unfixed> (embed; bug #560856)
742    
743    vgabios
744            - kvm <removed> (embed; bug #489442)
745            - qemu-kvm <unfixed> (embed)
746    
747    bochs
748            - kvm <removed> (embed; bug #489442)
749            - qemu-kvm <unfixed> (embed)
750    
751    speex
752            - vorbis-tools <unfixed> (embed)
753            NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
754            - gst-plugins-good0.10 <unfixed> (embed)
755            - xine-lib <unfixed> (embed)
756            - libfishsound <unfixed> (embed)
757            - libannodex <removed> (embed)
758            - opal 3.4.2~dfsg-2 (embed)
759            - mumble 1.2.0~beta1-1 (embed)
760            - vlc <unfixed> (embed)
761            - xmms-speex <unfixed> (embed)
762            - libsdl-sound1.2 <unfixed> (embed)
763            - sweep <unfixed> (embed)
764    
765    libreadline
766            - magic <itp> (old-version)
767    
768    opcode
769            - ode <unfixed> (embed)
770            NOTE: opcode is not a package in debian, it is just embedded
771            NOTE: http://www.codercorner.com/Opcode.htm
772    
773    gimpact
774            - ode <unfixed> (embed)
775            NOTE: gimpact is not a package in debian, it is just embedded
776            NOTE: http://gimpact.sf.net
777    
778    mochikit
779            - mahara <unfixed> (embed)
780            NOTE: they require extra patches, still unmerged upstream
781            - ntop <unfixed> (embed)
782            - coherence 0.6.2-1 (embed)
783            - paste <unfixed> (embed)
784            - turbogears <unfixed> (embed)
785            - plone3 <removed> (embed)
786            - xulrunner <unfixed> (embed)
787            - libjifty-plugin-chart-perl <unfixed> (embed)
788            - sabnzbdplus <unfixed> (embed)
789            - tgmochikit <unfixed> (embed)
790    
791    prototypejs
792            - netbeans-ide 6.0.1+dfsg-2 (embed)
793            - auth2db 0.2.5-2+dfsg-1 (embed; bug #555218)
794            - webcit <unfixed> (embed; bug #555219)
795            - asterisk 1:1.6.2.0~rc3-1 (embed)
796            - libjson-ruby 1.1.4-1 (embed; bug #555224)
797            - lucene2 2.9.1+ds1-2 (embed; bug #555226)
798            - horde3 <unfixed> (embed)
799            - knowledgeroot 0.9.8.5-4 (embed; bug #555230)
800            - mediatomb 0.12.0~svn2018-5 (embed; bug #555233)
801            - mt-daapd 0.9~r1696.dfsg-6lenny2 (embed)
802            - ebug-http <unfixed> (embed; bug #555236)
803            - libaws 2.7-1 (embed; bug #555222)
804            - phpgedview <removed> (embed)
805            - poker-network 1.7.6-1 (embed; bug #555238)
806            - rails 2.1.0-6 (embed)
807            - wordpress 2.5.0-2 (embed; bug #555243)
808            - zope <not-affected> (the prototypejs embed is not in any of the obvious zope packages, e.g. zope2.9, zope2.10, zope2.11, and zope3)
809            TODO: search through all of the other zope packages
810            - ampache 3.4.1-2 (embed)
811            - exaile 0.2.14+debian-2.1 (embed; bug #555245)
812            - hobix 0.5~svn20070319-4 (embed; bug #555247)
813            - zabbix 1.6.6-4 (embed; bug #555250)
814            - chora2 2.1.1+debian0-1 (embed; bug #555253)
815            - gollem 1.1.1+debian0-1 (embed; bug # 555254)
816            - jscropperui 1.2.1-1 (embed; bug #555257)
817            - scriptaculous <not-affected> (uses system prototype.js since initial upload; bug #555260)
818            - ingo1 1.2.3+debian0-1 (embed; bug #555261)
819            - kronolith2 2.3.3+debian0-1 (embed; bug #555262)
820            - activeldap 1.2.1-1 (embed)
821            - libv8 <not-affected> (contains a google-specific implementation of prototype.js)
822            - mantis 1.1.2+dfsg-1 (embed; bug #555265)
823            - otrs2 2.3.4-6 (embed; bug #555267)
824            - webcalendar 1.2~b1-2 (embed; bug #555269)
825            - redmine 0.9.0~svn2907-1 (embed; bug #555270)
826            - jifty 0.90519-1 (embed; bug #555271)
827            - jquery 1.4-1 (embed; bug #555272)
828            - passenger 2.2.5debian1-1 (embed; bug #555273)
829            - plone3 <removed> (embed; bug #555275)
830            - wesnoth <not-affected> (prototype.js not included in any of the binary packages; bug #555277)
831            - libhtml-prototype-perl 1.48-3 (embed; bug #538920)
832            - xulrunner <unfixed> (embed)
833            NOTE: included in iceweasel/xulrunner unit tests directory, so may not be security-relevant
834            - jclicmoodle <unfixed> (embed)
835            - git-cola <unfixed> (embed)
836    
837    gdb
838            - insight <unfixed> (embed)
839    
840    e2fsprogs
841            - ldiskfsprogs <unfixable> (fork)
842    
843    quazip (not packaged in Debian)
844            - qcake <unfixed> (embed)
845            NOTE: starting with upstream version 0.6.4
846    
847    exo
848            - pcmanfm <unfixed> (embed; bug #499677)
849            NOTE: slightly modified source code
850    
851    java
852            - openjdk-6 <unfixed>
853            - sun-java5 <unfixed>
854            - sun-java6 <unfixed>
855    
856    libphp-snoopy
857            - ampache 3.4.1-2 (embed; bug #504169)
858            - gforge 4.6.99+svn6094-2 (embed)
859            - mahara 1.0.5-2 (embed; bug #504170)
860            - pixelpost 1.7.1-5 (embed; bug #504171)
861            - mediamate 0.9.3.6-5 (embed; bug #504172)
862            - opendb <removed> (embed; bug #504173)
863            [etch] - opendb <unfixed> (embed; bug #504173)
864            - wordpress 2.5.1-9 (embed; bug #443948)
865            - moodle <unfixed> (embed; bug #507185)
866            [etch] - phpgroupware <unfixed> (embed)
867            NOTE: phpgroupware-felamimail
868            - magpierss 0.72-3 (embed; bug #431089)
869    
870    jquery
871            - zekr <unfixed> (embed)
872            - wordpress <unknown> (embed)
873            - yocto-reader <unfixed> (embed)
874            - textpattern <unfixed> (embed)
875            - genshi 0.5.1-1 (embed)
876            NOTE: compressed file under examples/ dir
877            - prewikka <unfixed> (embed)
878            - libramaze-ruby <unfixed> (embed)
879            - drupal6 <unfixed> (embed)
880            - b2evolution <unfixed> (embed)
881            - wesnoth <unfixed> (embed)
882    
883    tablesorter (jquery plugin, not packaged yet)
884            - wesnoth <unfixed> (embed)
885    
886    kses
887            - wordpress <unfixed> (embed; bug #504242)
888            NOTE: their copy has all methods renamed to wp_<foo>
889            NOTE: kses isn't in Debian, RFP: #504240
890            - moodle <unfixed> (embed; bug #507185)
891            - egroupware <unfixed> (embed)
892    
893    magpierss
894            - wordpress <unfixed> (embed; bug #504242)
895            - moodle <unfixed>
896    
897    php-gettext
898            - wordpress 2.8.4-1 (embed; bug #504242)
899            - docbookwiki <unfixed> (embed)
900            - knowledgeroot 0.9.9.5-1
901            NOTE: non-free
902    
903    libphp-ixr (name may change, it is the Incutio XML-RPC)
904            - wordpress <unfixed> (embed; bug #504242)
905            NOTE: libphp-ixr isn't in Debian, RFP: #504236
906            - dokuwiki <unfixed> (embed)
907            - textpattern <unfixed> (embed)
908    
909    libphp-cas
910            - glpi <unfixed> (embed)
911            - moodle <unfixed> (embed; bug #505984)
912    
913    scriptaculous (prototype.js is among the embeds in the following)
914            - glpi <unfixed> (embed)
915            - libaws <unfixed> (embed; bug #555222)
916            - op-panel <unfixed> (embed)
917            - symfony <unfixed> (embed)
918            NOTE: maintainer says there are extra incompatible changes required
919            - pixelpost 1.7.1-6 (embed)
920            - webhelpers <unfixed> (embed)
921            - qwik <removed> (embed; bug #555241)
922            - smokeping <unfixed> (embed)
923            - turba2 <unfixed> (embed)
924            - typo3-src 4.2.3-1 (embed)
925            - request-tracker3.6 <unfixed> (embed)
926            - request-tracker3.8 <unfixed> (embed)
927            - rt-extension-emailcompletion <not-affected> (prototype.js not included in the binary package)
928            - wordpress 2.5.0-2 (embed)
929            - libhtml-prototype-perl 1.48-3 (embed)
930    
931    libmarkdown-php
932            - moodle <unfixed> (embed; bug #507185)
933            - pixelpost 1.7.1-6 (embed)
934    
935    php-openid
936            - wordpress-openid 3.3.2-1 (embed)
937    
938    geshi
939            - dokuwiki 0.0.20080505-3.1 (embed)
940            - pgfouine 1.0-1.1 (embed)
941            - websvn 2.1.0-1 (embed)
942    
943    webcalendar
944            - gforge 4.7~rc2-6 (embed; bug #504758)
945    
946    libical
947            - kdepim <unknown> (fork)
948            NOTE: fixed at some point during 4.0
949            - kdepimlibs 4.2.0-1 (fork)
950            - claws-mail-extra-plugins <unfixed> (fork)
951    
952    harfbuzz
953            - qt4-x11 <unfixed> (embed)
954            - pango1.0 <unfixed> (embed)
955            - fontmatrix <unfixed> (embed)
956    
957    libzip
958            - php5 <unfixable> (modified-embed)
959            - odt2txt <unfixed> (embed; bug #523808)
960    
961    json.php (not packaged; should be replaced with php's built-in functions)
962            - moodle <unfixed>
963            - yui <unfixed>
964            - gallery2 <unfixed>
965            - dokuwiki <unfixed>
966            - typo3-src <unfixed>
967    
968    php-fpdf
969            - tcpdf <itp> (fork)
970            - moodle <unfixed>
971            - phpwiki <unfixed>
972            - egroupware <unfixed>
973            - ldap-account-manager <unfixed> (fork)
974    
975    tcpdf (itp: #495985)
976            - moodle <unfixed>
977            - phpmyadmin <unfixed>
978    
979  uw-imap:  typo3
980  pine          - moodle <unfixed>
 alpine  
981    
982  imagemagick:  spreadsheet_writeexcel (PHP port of libspreadsheet-writeexcel-perl; itp: #487557)
983  graphicsmagick          - moodle <unfixed>
984            - gosa <unfixed>
985    
986    php-ole (itp: #487558)
987            - moodle <unfixed>
988    
989    pieforms (http://www.catalyst.net.nz)
990            - mahara <unfixed>
991    
992    savant2 (http://phpsavant.com)
993            - egroupware <unfixed>
994    
995    rssparser (http://nwow.org)
996            - egroupware <unfixed>
997            - phpgroupware <unfixed>
998    
999    lcms
1000            - openjdk-6 <unfixed> (fork)
1001            - gimp 2.4.0~rc2-2
1002    
1003    libphp-phplayersmenu
1004            - diogenes <unfixed>
1005            - phpldapadmin <unfixed>
1006    
1007    libphp-pclzip
1008            - docvert <unfixed>
1009            - moodle <unfixed>
1010            - egroupware <unfixed>
1011    
1012    libphp-simplepie
1013            - dokuwiki <unfixed>
1014            - wordpress <unfixed>
1015    
1016    libphp-jpgraph
1017            - egroupware <unfixed>
1018    
1019    php-simpletest
1020            - moodle <unfixed>
1021    
1022    libpng
1023            - iceweasel <not-affected> (uses xulrunner)
1024            - icedove 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1, 2.0.0.19-1 (embed)
1025            - iceape 1.0.13~pre080614i-0etch1 (embed)
1026            - xulrunner 1.9.0.13-1 (embed)
1027            [lenny] - xulrunner 1.9.0.11-0lenny1
1028            [etch] - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
1029            - gamera 3.2.3-1 (embed)
1030            - freeimage <unfixed> (embed)
1031            - tuxonice-userui <unfixed> (static)
1032    
1033    irssi
1034            - silc-client <unfixed> (embed)
1035            NOTE: Seems to be a pre-0.8.12 version that is used in irssi-plugin-silc
1036    
1037    extc
1038            - mtasc <unfixed> (embed)
1039            - haxe <unfixed> (embed)
1040    
1041    swflib
1042            - mtasc <unfixed> (embed)
1043            - haxe <unfixed> (embed)
1044    
1045    libitext-java
1046            - bouncycastle 2.1.4-1 (embed)
1047    
1048    python-ply
1049            - pyke <unfixed> (embed; bug #555363)
1050            - pywbem 0.7.0-4 (embed; bug #555364)
1051            - sepolgen <unfixed> (embed; bug #555365)
1052            - zope-textindexng3 <unknown> (embed)
1053            - iceweasel <not-affected> (uses xulrunner)
1054            - xulrunner <unknown> (embed)
1055            - wireshark <not-affected> (python-ply modules are not installed into binary packages; see #554613)
1056    
1057    libdumbnet (libdnet upstream)
1058            - nmap <unfixed> (fork)
1059    
1060    gcc-4.4
1061            - gcc-mingw32 <unfixed> (embed)
1062    
1063    camlimages
1064            - advi <unfixed> (static; bug #550441)
1065    
1066    memcached
1067            - memcachedb <unfixed> (embed)
1068    
1069    yajl
1070            - argyll <unfixed> (embed; bug #544223)
1071            NOTE: reference, confirmed by build logs: http://lists.debian.org/debian-mentors/2009/08/msg00062.html
1072    
1073    nusoap
1074            - gforge 4.8.2-1 (embed)
1075            - ampache <unfixed> (embed)
1076            - poker-network <unfixed> (embed)
1077            - moodle <unfixed> (embed)
1078            NOTE: code is not used when running under php5 and soap is enabled
1079            - phpwiki <unfixed> (embed)
1080            - gallery2 <unfixed> (embed)
1081            - typo3-src <unfixed> (embed)
1082            - phpgacl 3.3.7-7 (embed)
1083            - mantis 1.1.8+dfsg-1 (embed)
1084    
1085    libept
1086            - adept <unfixed> (embed; bug #540649)
1087    
1088    libvorbis
1089            - iceweasel <not-affected> (uses xulrunner)
1090            - xulrunner <unfixed> (embed; bug #540959)
1091            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1092            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1093            - iceape <unfixed> (embed)
1094            [etch] - iceape <not-affected> (introduced in 2.0)
1095            [lenny] - iceape <not-affected> (introduced in 2.0)
1096    
1097    cairo
1098            - iceweasel <not-affected> (uses xulrunner)
1099            - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
1100    
1101    liboggz
1102            - iceweasel <not-affected> (uses xulrunner)
1103            - xulrunner <unfixed> (embed; bug #540959)
1104            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1105            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1106            - iceape <unfixed> (embed)
1107            [etch] - iceape <not-affected> (introduced in 2.0)
1108            [lenny] - iceape <not-affected> (introduced in 2.0)
1109    
1110    liboggplay
1111            - iceweasel <not-affected> (uses xulrunner)
1112            - xulrunner <unfixed> (embed; bug #540959)
1113            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1114            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1115            - iceape <unfixed> (embed)
1116            [etch] - iceape <not-affected> (introduced in 2.0)
1117            [lenny] - iceape <not-affected> (introduced in 2.0)
1118    
1119    php-net-dnsbl
1120            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1121    
1122    php-onyx-rss
1123            - serendipity <unfixed> (embed; bug #541740; wontfix: only one script, own package is overkill, appears not to be duplicated in Debian)
1124    
1125    php-text-wiki
1126            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1127    
1128    php-xml-rpc
1129            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1130    
1131    polarssl (does not have a shared library)
1132            - pdkim <itp> (embed; bug #543150)
1133            - xyssl <unfixed> (old-version)
1134    
1135    pidgin (libpurple)
1136            - gaim <removed> (old-version)
1137            - qutecom 2.2~rc3.hg396~dfsg1-6 (embed; bug #559785)
1138    
1139    icu
1140            - webkit 1.0.1-1 (embed; bug #547214)
1141            - texlive-bin <unfixed> (fork)
1142            NOTE: texlive upstream working with icu upstream to merge their changes
1143            - chromium-browser 5.0.375.29~r46008-3
1144    
1145    cyrus-imapd-2.2
1146            - kolab-cyrus-imapd <unfixed> (fork)
1147            - dovecot 1:1.2.1-1 (embed) [/dovecot-sieve/src/libsieve/*]
1148    
1149    python-cxx-dev
1150            - freecad 0.9.2646.3-1 (embed; bug #547936)
1151    
1152    zipios++
1153            - freecad 0.9.2646.3-1 (embed; bug #547941)
1154            - enigma 0.92.3-3 (embed)
1155            NOTE: likely fixed earlier, marking etch's version as fixed
1156    
1157    linux-2.6
1158            - kvm <removed> (embed; bug #549973) [./kernel/*]
1159            - linux-kbuild-2.6 <unfixed> (embed; bug #550379) [./kbuild/*]
1160            - kernel-source-2.6.8 <removed> (old-version)
1161            - kernel-source-2.4.27 <removed> (old-version)
1162            - kernel-source-2.4.24 <removed> (old-version)
1163            - kernel-source-2.2.25 <removed> (old-version)
1164            - kernel-source-2.2.20 <removed> (old-version)
1165    
1166    libfdt (not yet packaged separately for debian; http://www.jdl.com/software/)
1167            - kvm <removed> (embed) [./libfdt/*]
1168            - qemu-kvm <unfixed> (embed) [./libfdt/*]
1169    
1170    qweb (not packaged)
1171            - ajaxterm <unfixed>
1172    
1173    opensaml2
1174            - opensaml <removed> (old-version)
1175    
1176    shibboleth-sp2
1177            - shibboleth-sp <removed> (old-version)
1178    
1179    tuxonice-userui
1180            - suspend2-userui <removed> (old-version)
1181    
1182    expat
1183            - w3c-libwww <removed> (embed; bug #551941)
1184            [etch] - w3c-libwww <unfixed> (embed; bug #551941) [./modules/expat/*]
1185            - python-xml <unfixed> (embed; bug #551940) [./extensions/expat/*]
1186            - python2.5 <unfixable> (embed; bug #553403) [./Modules/expat/*]
1187            - python2.4 <unfixable> (embed; bug #553403)
1188            - python2.7 2.7-6 (embed)
1189            - python-4suite <unfixed> (embed; bug #516935)
1190            - wxwindows2.4 <removed> (embed)
1191            - wxwidgets2.6 2.6.3.2.2-4 (embed)
1192            - wxwidgets2.8 2.8.10.1-2 (embed)
1193            - albert <unfixed> (embed; bug #600974)
1194            - celementtree 1.0.5-8 (embed)
1195            NOTE: Maybe that was fixed even earlier
1196            - centerim <unfixed> (embed; bug #559783)
1197            - audacity 1.3.2-1 (embed)
1198            - matanza <unfixed> (embed)
1199            - tdom 0.8.3~20080525-1 (embed)
1200            - udunits 2.1.8-4 (embed)
1201            - apr-util 1.2 (embed)
1202            - ayttm <unfxed> (embed; bug #561006)
1203            - cableswig <unfixed> (embed)
1204            - cadaver <unfixed> (embed)
1205            - cmake 2.6.0-6 (embed)
1206            - coin3 <unfixed> (embed)
1207            - cvsnt <unknown> (embed)
1208            - dasher <unknown> (embed)
1209            - gdcm 2.0.14-2 (embed)
1210            - ghostscript 8.71~dfsg-2 (embed)
1211            - grmonitor <removed> (embed)
1212            - iceape <unfixed> (embed)
1213            - insighttoolkit 3.16.0-1 (embed)
1214            NOTE: insighttoolkit might've been fixed earlier
1215            - jabber <unknown> (embed)
1216            - libparagui1.1 1.0.2-1 (embed)
1217            - libspiff <unknown> (embed)
1218            - mcabber <unfixed> (embed; bug #601053)
1219            - paraview 3.6.2-1 (embed)
1220            - poco 1.3.6p1-1 (embed)
1221            - scorched3d <unknown> (embed)
1222            - simgear <unfixed> (embed)
1223            - sitecopy 1:0.16.0-1
1224            - smart <unfixed> (embed)
1225            NOTE: smart embeds celementree, and it includes expat
1226            - swish-e <not-affected> (Linked against libxml, which is used instead)
1227            - tla 1.3.5+dfsg-15 (embed)
1228            - vtk 4.1.20030227-1 (embed)
1229            - wbxml2 <not-affected> (expat code is only used on Mac OS X, see #560941)
1230            - xmlrpc-c <unfixed> (embed)
1231            - iceweasel <unfixed> (embed)
1232            - kompozer <unfixed> (embed)
1233            - vxl 1.13.0-2 (embed)
1234            - xulrunner <unfixed> (embed)
1235            - xmame <unknown> (embed)
1236            - apache2 2.2 (embed)
1237            - texlive-bin <not-affected> (Embedded code not compiled in)
1238            - vnc4 <unfixed> (embed)
1239            - xotcl 1.6.6-1 (embed)
1240            - chromium-browser 5.0.375.29~r46008-3
1241    
1242    xerces-c
1243            - xerces-c2 <unfixed> (old-version)
1244            - xerces27 <removed> (old-version)
1245    
1246    md5 (RSA's version; not the gnu version provided by coreutils)
1247            - w3c-libwww <removed> (embed; bug #551942)
1248            [etch] - w3c-libwww <unfixed> (embed; bug #551942) [./modules/md5/*]
1249    
1250    libparagui1.1
1251            - asc <unfixable> (fork)
1252    
1253    enet
1254            - sauerbraten <unfixed> (embed; #497194)
1255    
1256    eglibc
1257            - glibc <removed> (old-version)
1258            - mksh <unfixable> (static)
1259              NOTE: /bin/mksh-static only, and only on some arches (others use dietlibc)
1260    
1261    galib
1262            - gamera 3.2.3-1 (embed)
1263    
1264    configobj
1265            - bzr 2.1.0~rc2-1 (embed; bug #555336)
1266            - elisa <unfixed> (embed; bug #555337)
1267            - gaupol <unfixed> (embed; bug #555338)
1268            - ipython <unfixed> (embed; bug #555339)
1269            - pida <unfixed> (embed; bug #555340)
1270            - psychopy <unfixed> (embed; bug #555341)
1271            - rest2web <unfixed> (embed; bug #555342)
1272            - auth2db <unknown> (embed)
1273            - dynagen <unknown> (embed)
1274            - iceweasel <unknown> (embed)
1275            - sabnzbdplus <unknown> (embed)
1276            - xulrunner <unknown> (embed)
1277            - nipy <not-affected> (part of an example [/examples/neurospin/neurospy/configobj.py], which is not installed into binary packages)
1278    
1279    python-clientform
1280            - bibus <unfixed> (embed; bug #555332)
1281            - zope2.10 <unfixed> (embed; bug #555333)
1282            - zope2.11 <removed> (embed; bug #555334)
1283            - python-mechanize <unknown> (embed)
1284            - twill <unknown> (embed)
1285    
1286    python-mechanize
1287            - zope2.10 <unfixed> (embed; bug #555337)
1288            - zope2.11 <removed> (embed; bug #555338)
1289            - twill <unknown> (embed; bug #555339)
1290    
1291    pexpect
1292            - duplicity 0.6.06-1 (embed; bug #555361)
1293            - hplip <unfixed> (embed; bug #555362)
1294            - smart <unfixed> (embed; bug #555363)
1295    
1296    pyparsing
1297            - bauble <unfixed> (embed; bug #555366)
1298            - boa-constructor 0.6.1-8 (embed; bug #555367)
1299            - calibre <unfixed> (embed; bug #555368)
1300            - matplotlib <unfixed> (embed; bug #531024)
1301            - zhpy 1.7.3.1-1 (embed; bug #555370)
1302            - polybori <unknown> (embed)
1303            - python-whoosh <unknown> (embed)
1304            - twill <unknown> (embed)
1305            - zope-textindexng3 <unknown> (embed)
1306    
1307    python-pysqlite2
1308            - python2.4 <unfixed> (embed; bug #553403)
1309            - python2.5 <unfixed> (embed; bug #553403)
1310    
1311    celementtree
1312            - python2.5 <unfixed> (embed)
1313            - smart <unfixed> (embed)
1314    
1315    elementtree
1316            - python2.5 <unfixed> (embed)
1317            - python2.6 <unfixed> (embed)
1318            - bzr 2.1.0~rc2-1 (embed; bug #555343)
1319            - gedit 2.28.2-1 (embed; bug #555344)
1320            - smart <unfixed> (embed)
1321            - solfege <unfixed> (embed; bug #555345)
1322            - w3af <unfixed> (embed; bug #555346)
1323            - python-qt4 <unknown> (embed)
1324            - sphinx <unknown> (embed)
1325            - python-nltk <itp> (embed)
1326    
1327    python2.5
1328            - python2.4 <unfixed> (old-version)
1329            - jython <unfixed> (embed)
1330            NOTE: embeds many stdlib modules
1331            - python-django <unfixed> (embed; bug #555419)
1332            NOTE: embeds stdlib modules: doctest, decimal
1333            - gamera 3.2.3-1 (embed)
1334            NOTE: embeds stdlib modules: ConfigParser, optparse, sets, textwrap
1335            - boa-constructor <unfixed> (embed; bug #555426)
1336            NOTE: embeds stdlib modules: ConfigParser, tarfile, zipfile, xmlrpclib
1337            - nicotine <unfixed> (embed; bug #555427)
1338            NOTE: embeds stdlib modules: ConfigParser
1339            - museek+ <unfixed> (embed; bug #555428)
1340            NOTE: embeds stdlib modules: ConfigParser
1341            - vegastrike-data <removed> (embed)
1342            NOTE: embeds many stdlib modules
1343            - codespeak-lib 1.1.1-1 (embed; bug #555420)
1344            NOTE: embeds stdlib modules: doctest, optparse, subprocess, textwrap
1345            - config-manager <unfixed> (embed; bug #555423)
1346            NOTE: embeds stdlib modules: optparse
1347            - jhbuild 2.28.0-1 (embed; bug #555421)
1348            NOTE: embeds stdlib modules: optparse, subprocess
1349            - smart <unfixed> (embed; bug #555432)
1350            NOTE: embeds stdlib modules: optparse
1351            - pyprotocols 1.0a.svn20070625-5 (embed; bug #555433)
1352            NOTE: embeds stdlib modules: doctest
1353            - ruledispatch 0.5a.svn20080510-4 (embed; bug #555434)
1354            NOTE: embeds stdlib modules: doctest
1355            - distribute <unfixed> (embed)
1356            NOTE: embeds stdlib modules: doctest
1357            - python-setuptools <unfixed> (embed; bug #555435)
1358            NOTE: embeds stdlib modules: doctest
1359            - zope.testing <unfixed> (embed; bug #555436)
1360            NOTE: embeds stdlib modules: doctest
1361            - translate-toolkit <unfixed> (embed; bug #555422)
1362            NOTE: embeds stdlib modules: textwrap, contextlib
1363            - libtpclient-py <unfixed> (embed; bug #555424)
1364            NOTE: embeds stdlib modules: subprocess
1365            - grass <unfixed> (embed; bug #555425)
1366            NOTE: embeds stdlib modules: subprocess
1367            - coherence <unfixed> (embed; bug #555429)
1368            NOTE: embeds stdlib modules: uuid
1369            - python-django-extensions 0.4.2pre+git200911182050-1 (embed; bug #555430)
1370            NOTE: embeds stdlib modules: uuid
1371            - setroubleshoot <removed> (embed; bug #555431)
1372            NOTE: embeds stdlib modules: uuid
1373            - linkchecker <unfixed> (embed; bug #555414)
1374            NOTE: embeds msgfmt.py script
1375            - imdbpy <unfixed> (embed)
1376            NOTE: embeds msgfmt.py script
1377            - kiwi <unfixed> (embed)
1378            NOTE: embeds msgfmt.py script
1379            - moin <unfixed> (embed)
1380            NOTE: embeds msgfmt.py script, stdlib modules: cgitb, difflib, tarfile
1381            - plone3 <removed> (embed)
1382            NOTE: embeds msgfmt.py script
1383            - roundup <unfixed> (embed)
1384            NOTE: embeds msgfmt.py script, stdlib modules: cgitb
1385            - rednotebook <unfixed> (embed; bug #555415)
1386            NOTE: embeds msgfmt.py script
1387            - turbogears <unfixed> (embed)
1388            NOTE: embeds msgfmt.py script
1389            - elisa <unfixed> (embed)
1390            NOTE: embeds msgfmt.py script, stdlib modules: uuid
1391            - calibre <unfixed> (embed)
1392            NOTE: embeds msgfmt.py script, stdlib modules: zipfile
1393            - mailman 1:2.1.13-1 (embed; #555416)
1394            NOTE: embeds msgfmt.py script
1395            - python-docutils <unknown> (embed)
1396            NOTE: embeds stdlib modules: optparse, textwrap
1397            - python-imaging <unknown> (embed)
1398            NOTE: embeds stdlib modules: doctest
1399            - python-mechanize <unknown> (embed)
1400            NOTE: embeds stdlib modules: doctest
1401            - twill <unknown> (embed)
1402            NOTE: embeds stdlib modules: subprocess
1403            - zeroc-ice <unknown> (embed)
1404            NOTE: embeds stdlib modules: subprocess
1405            - wxwidgets2.8 <unknown> (embed)
1406            NOTE: embeds stdlib modules: subprocess
1407            - cycle <unknown> (embed)
1408            NOTE: embeds msgfmt.py script
1409            - deluge <unknown> (embed)
1410            NOTE: embeds msgfmt.py script
1411            - opendict <unknown> (embed)
1412            NOTE: embeds msgfmt.py script
1413            - openerp-client <unknown> (embed)
1414            NOTE: embeds msgfmt.py script
1415            - rapidsvn <unknown> (embed)
1416            NOTE: embeds msgfmt.py script
1417            - wammu <unknown> (embed)
1418            NOTE: embeds msgfmt.py script
1419            - gaphor <unknown> (embed)
1420            NOTE: embeds msgfmt.py script
1421            - pida <unknown> (embed)
1422            NOTE: embeds msgfmt.py script
1423            - python-formencode <unknown> (embed)
1424            NOTE: embeds msgfmt.py script
1425            - duplicity <unfixed> (embed)
1426            NOTE: embeds stdlib module: urlparse, tarfile
1427            - pygopherd <unfixed> (embed)
1428            NOTE: embeds stdlib module: zipfile
1429    
1430    argparse
1431            - twill <unfixed> (embed; bug #555347)
1432            - ipython <unfixed> (embed; bug #555348)
1433    
1434    coherence
1435            - elisa <unfixed> (embed; bug #555335)
1436    
1437    simpletal
1438            - plastex <unfixed> (embed; bug #555371)
1439    
1440    flickrpc (not packaged in Debian, http://burtonini.com/bzr/flickrpc/)
1441            - postr <unfixed> (embed)
1442            - elisa <unfixed> (embed)
1443    
1444    simplegeneric (not packaged in Debian, http://pypi.python.org/pypi/simplegeneric)
1445            - apertium-tolk <unfixed> (embed)
1446            - ipython <unfixed> (embed)
1447            - virtaal <unfixed> (embed)
1448    
1449    distribute
1450            - setuptools <removed> (old-version)
1451    
1452    rails
1453            - jruby1.2 <removed> (embed) [./bench/rails/*]
1454            NOTE: jruby is in non-free, it probably includes rails too
1455            - libgettext-ruby <unfixed> (embed) [./samples/rails/*]
1456            - libopenid-ruby <unfixed> (embed) [./examples/rails_openid/*]
1457            - thin <unfixed> (embed) [./spec/rails_app/*]
1458            NOTE: this is a subdirectory of examples, which in general is a non-issue, but may
1459            NOTE: be dangerous if developers are naively basing their code off of the examples
1460            NOTE: prototype.js is among the example files
1461    
1462    lucene2 (prototype.js is among the embeds in the following)
1463            - lucene <unfixed> (old-version)
1464            - pylucene <unfixed> (embed)
1465            - libpdfbox-java <unfixed> (embed)
1466            - libfontbox-java <unfixed> (embed)
1467            - libjempbox-java <unfixed> (embed)
1468            - solr <unfixed> (embed)
1469    
1470    unicode-data
1471            - syslinux <unfixed> (embed)
1472            - camomile <unfixed> (embed)
1473            - fribidi <unfixed> (embed)
1474            - m17n-db <unfixed> (embed)
1475            - sbcl <unfixed> (embed)
1476            - heimdal <unfixed> (embed)
1477            - icu <unfixed> (embed)
1478            - icu4j <unfixed> (embed)
1479            - krb5 <unfixed> (embed)
1480            - moodle <unfixed> (embed)
1481            - openldap <unfixed> (embed)
1482            - pike7.6 <unfixed> (embed)
1483            - samba <unfixed> (embed)
1484            - samba4 <unfixed> (embed)
1485            - cmucl <unfixed> (embed)
1486            - typo3-src <unfixed> (embed)
1487            - mauve <unfixed> (embed)
1488            - texlive-bin <unfixed> (embed)
1489            - ypsilon <unfixed> (embed)
1490            - jeuclid <unfixed> (embed)
1491            - charmap.app <unfixed> (embed)
1492            - clisp <unfixed> (embed)
1493            - gnulib <unfixed> (embed)
1494            - opensrs-client <unfixed> (embed)
1495            - saxonb <unfixed> (embed)
1496            - rails <unfixed> (embed)
1497    
1498    feedparser
1499            - rawdog <unfixed> (embed; bug #383422)
1500            - miro <unfixed> (embed; bug #555351)
1501            - calibre <unfixed> (embed; bug #555352)
1502            - freevo <unfixed> (embed; bug #555353)
1503            - pida <unfixed> (embed; bug #555354)
1504            - planet-venus <unfixed> (embed; bug #555355)
1505            - plone3 <removed> (embed; bug #555356)
1506            - exaile 0.2.14+debian-1 (embed)
1507            - screenlets 0.1.2-3 (embed)
1508            NOTE: included twice
1509    
1510    agg:
1511            - matplotlib <unfixed> (embed: bug #377271)
1512            - contextfree <unfixed> (embed)
1513            NOTE: since 2.2-1 it links statically to system libagg, but still uses the embedded copy
1514            - exactimage <unfixed> (embed)
1515            - python-enable <unfixed> (embed)
1516            - mapnik 0.5.1-3 (embed)
1517            NOTE: links statically to agg, but shared library is not available (bug #377271)
1518    
1519    vtk
1520            - paraview <unfixable> (embed; bug #495426)
1521    
1522    txt2tags
1523            - rednotebook <unfixed> (embed)
1524    
1525    htmltextview (not packaged in Debian, http://www.gnome.org/~gjc/htmltextview.py)
1526            - gajim <unfixed> (embed)
1527            - emesene <unfixed> (embed)
1528            - convirt <unfixed> (embed)
1529            - pida <unfixed> (embed)
1530            - rednotebook <unfixed> (embed)
1531    
1532    horde3 (prototype.js is among the embeds in the following)
1533            - mnemo2 <unfixed> (embed)
1534            - nag2 <unfixed> (embed)
1535            - wordpress <unfixed> (embed)
1536            NOTE: Text_Diff (wp-includes/Text/Diff*)
1537    
1538    cimg
1539            - gmic <unfixed> (embed)
1540    
1541    mootools
1542            - kdenetwork <unfixed> (embed)
1543            - gallery <unfixed> (embed)
1544            - jspwiki <unfixed> (embed)
1545            - vdr-plugin-live <unfixed> (embed)
1546            - perl-doc-html <unfixed> (embed)
1547    
1548  halibut:  openldap
1549  nsis          - openldap2.3 <removed> (old-version)
1550    
1551  libghttp:  grub2
1552  hotway          - grub <unfixed> (old-version)
1553    
1554  libsndfile:  gnupginterface
1555  ardour          - duplicity <unfixed> (embed)
1556    
1557  glibmm2.4:  python-dateutil
1558  ardour          - awn-extras-applets <unfixed> (embed)
1559            - matplotlib <unknown> (embed)
1560    
1561    cups
1562            - cupsys <removed> (old-version)
1563    
1564    yui
1565            - bcfg2 <not-affected> (present in source but not included in any binary files)
1566            - serendipity 1.5.3-1 (embed; bug #557746)
1567            - moodle 1.8.2.dfsg-5 (embed)
1568            - jifty 0.91117-1 (embed; bug #557748)
1569            - webgui 7.7.26-1 (embed)
1570            - loggerhead 1.17-1 (embed)
1571            - otrs2 2.4.7+dfsg1-1 (embed; bug #592146)
1572    
1573    quake3 (vanilla source not packaged in debian)
1574            - openarena <unfixable> (fork)
1575    
1576    quake2 (vanilla source not packaged in debian)
1577            - alien-arena <unfixable> (fork)
1578            - warsow <unfixable> (fork)
1579    
1580    libtheora
1581            - iceweasel <not-affected> (uses xulrunner)
1582            - xulrunner <unfixed> (embed; bug #540959)
1583            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1584            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1585            - iceape <unfixed> (embed; bug #559276)
1586            [etch] - iceape <not-affected> (introduced in iceape 2.0)
1587            [lenny] - iceape <not-affected> (introduced in iceape 2.0)
1588    
1589    dtoa
1590            - bfilter <unfixed> (embed)
1591            - cacao <removed> (embed)
1592            - cdrdao <unfixed> (embed)
1593            - classpath <unfixed> (embed)
1594            - freej <unfixed> (embed)
1595            - iceape <unfixed> (embed)
1596            - iceweasel <unfixed> (embed)
1597            - jscoverage <unfixed> (embed)
1598            - kde4libs <unfixed> (embed)
1599            - kdelibs <unfixed> (embed)
1600            - kompozer <unfixed> (embed)
1601            - libv8 <unfixed> (embed)
1602            - mono <unfixed> (embed)
1603            - newlib <unfixed> (embed)
1604            - nspr <unfixed> (embed)
1605            - php5 <unfixed> (embed)
1606            - polyml <unfixed> (embed)
1607            - qt4-x11 <unfixed> (embed)
1608            - rhino <unfixed> (embed)
1609            NOTE: code translated to Java
1610            - ruby1.8 <unfixed> (embed)
1611            - ruby1.9 <unfixed> (embed)
1612            - ruby1.9.1 <unfixed> (embed)
1613            - sdd <unfixed> (embed)
1614            - sfind <unfixed> (embed)
1615            - star <unfixed> (embed)
1616            - tinymux <unfixed> (embed)
1617            - virtualbox-ose <unfixed> (embed)
1618            - webkit <unfixed> (embed)
1619            - xulrunner <unfixed> (embed)
1620    
1621    ipc (not packaged in Debian; see http://mozdev.org/pipermail/enigmail/2009-November/011678.html)
1622            - firegpg <unfixed> (embed)
1623            - enigmail <unfixed> (embed)
1624    
1625    ptmalloc (not packaged in Debian)
1626            - crystalspace <unfixed> (embed)
1627            - qt4-x11 <unfixed> (embed)
1628    
1629    svgalib
1630            - usplash <unfixed> (embed)
1631    
1632    bogl
1633            - usplash <unfixed> (embed)
1634    
1635    taglist
1636            - usplash <unfixed> (embed)
1637    
1638    portaudio
1639            - audacity <unfixed> (embed; bug #323711)
1640    
1641    nyquist
1642            - audacity <unfixed> (embed)
1643            NOTE: embeds a forked nyquist with support for a shared library
1644    
1645  libgnomecanvasmm2.6:  vamp-plugin-sdk
1646  ardour          - audacity <unfixed> (embed)
1647    
1648  libsigc++-2.0:  wordpress
1649  ardour          - libwordpress-xmlrpc-perl <removed> (embed) [./xmlrpc.php]
1650            - wordpress-mu <removed> (fork)
1651    
1652  soundtouch:  php5
1653  ardour          - php4 <removed> (old-version)
1654    
1655  libmms:  classpath
1656  xine-lib          - libgnucrypto-java <removed> (embed; bug #559788)
 mimms  
1657    
1658  FCKeditor: (packaged as fckeditor)  libtool
1659  knowledgeroot          - apr <unfixed> (static; bug #489625)
1660  moin (452599)          NOTE: ships copy of libtool in libapr1-dev; was 'embed' before 1.3.2-3
1661  karrigell (452598)          - arts <unfixed> (embed)
1662  gforge-plugins-extra (fixed since 4.6.99+svn6225-1)          - bochs 2.4.2-1 (embed; bug #560884)
1663            - camserv <unfixed> (embed)
1664            - collectd 4.8.2-1 (embed)
1665            - courier-authlib 0.58-4 (embed)
1666            NOTE: The etch version of courier-authlib was the earliest version checked, might be fixed earlier
1667            - cvsnt 2.5.04.3236-1.2 (embed)
1668            - dico <not-affected> (Uses the system copy of ltdl)
1669            - freeradius 0.1+20010527-1 (embed)
1670            NOTE: Earliest reference I could find from the changelog is from 27 May 2001
1671            - ggobi 2.1.9~20091212-1 (embed)
1672            - glame 2.0.1-4 (embed)
1673            NOTE: The etch version of glame was the earliest version checked, might be fixed earlier
1674            - gnash 0.8.7-2 (embed)
1675            - gnu-smalltalk <unfixed> (embed; bug #566777)
1676            - google-gadgets 0.10.5-0.3 (embed)
1677            NOTE: 0.10.5-0.3 was the earliest version checked, was fixed earlier
1678            - graphicsmagick 1.3.5-6 (embed)
1679            - graphviz 2.8-3 (embed)
1680            NOTE: The etch version of graphviz was the earliest version checked, might be fixed earlier
1681            - guile-1.6 1.6.8-7 (embed)
1682            - hamlib 1.2.11-1 (embed)
1683            - hercules 3.06-1.2 (embed)
1684            - jags 1.0.4-3 (embed; bug #560864)
1685            - kdelibs <unfixed> (embed)
1686            - libannodex <removed> (embed)
1687            - libextractor 0.5.23+dfsg-4 (embed)
1688            - libmcrypt <not-affected> (libtool source present but not included in any of the binary packages)
1689            - libtunepimp 0.5.3-7.3 (embed)
1690            - mp4h 1.3.1-4.1 (embed)
1691            - naim <removed> (embed)
1692            - parser-mysql <unfixed> (embed)
1693            - pinball 0.3.1-11 (embed)
1694            - redland <unfixed> (embed)
1695            - siproxd <unfixed> (embed)
1696            - ski <unfixed> (embed)
1697            - synfig 0.62.00-1 (embed)
1698            - unixodbc 2.2.4-5 (embed)
1699            - xmlsec1 <not-affected> (Doesn't enable dynamic loading of crypto modules)
1700            - clamav 0.95+dfsg-1 (embed)
1701            - imagemagick 6:6.2.3.1-1 (embed)
1702            - hypre 2.4.0b-5 (embed)
1703            - lam <unfixed> (embed)
1704            - openmpi <unfixable> (embed; bug #559386)
1705            - parser <unfixed> (embed)
1706            - pdsh 2.18-5 (embed; bug #560892)
1707            - sbnc 1.2-8 (embed)
1708            - sdcc <unfixed> (embed)
1709            - wml <not-affected> (The embedded ltdl isn't used, instead mp4h is used, see 559841)
1710            - proftpd-dfsg <unfixed> (embed; bug #561748)
1711            - babel 1.4.0.dfsg-5 (embed)
1712            - libprelude 0.9.14-2 (embed)
1713            - heartbeat 2.1.4-7 (embed)
1714            NOTE: From Squeeze onwards the system copy of ltdl is used, use the current version from Squeeze,
1715            NOTE: might've been fixed earlier
1716            - gcc-* <unknown> (embed)
1717    
1718    ocamlgsl
1719            - orpie 1.5.1-7.1 (embed; bug #550058)
1720    
1721    xdotool
1722            - keynav <unfixed> (embed; bug #560103)
1723    
1724    bulletphysics (not packaged; http://www.bulletphysics.org/)
1725            - supertuxkart <unfixed> (embed)
1726            - blender <unfixed> (embed)
1727    
1728    ghostscript
1729            - gs-gpl <removed> (old-version)
1730    
1731    icedove
1732            - thunderbird <removed> (old-version)
1733    
1734    sizzlejs (not packaged in Debian, http://sizzlejs.com/)
1735            - jquery <unfixed> (embed)
1736    
1737  Moodle contains lots of things:  sed
1738  AdoDB          - ssed <unfixed> (fork)
 AdoDB-XML Schema  
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
 TinyMCE  
 bennu  
1739    
1740  TinyMCE:  phpatomlib (http://code.google.com/p/phpatomlib)
1741  wordpress          - wordpress <unfixed> (embed)
1742  moodle  
1743  knowledgeroot  Services_JSON (http://pear.php.net/package/Services_JSON)
1744  joomla (ITP)          - wordpress <unfixed> (embed)
1745    
1746  scintilla:  phpass (http://www.openwall.com/phpass/)
1747  scite          - gallery2 <unfixed> (embed)
1748  qscintilla          - wordpress <unfixed> (embed)
1749  qscintilla2          - typo3-src <unfixed> (modified-embed)
1750  geany          NOTE: file refers to drupal, maybe there's a copy somewhere there
1751            NOTE: a copyright owner search didn't match anything
1752  libphp-adodb:          - libauthen-passphrase-perl <unfixable> (fork)
1753  gallery2          NOTE: perl implementation of phpass
1754  phppgadmin  
1755  egroupware  squirrelmail
1756  phpwiki          - wordpress <unfixed> (embed)
1757  ipplan          NOTE: class-pop3.php
1758  typo3  
1759  moodle  ezSQL (http://www.woyano.com/jv/ezsql)
1760  cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)          - wordpress <unfixable> (fork)
1761            NOTE: wp-db.php
1762    
1763    Diff.php (Clay Loveless' version/killersoft.com)
1764            - php-versioncontrol-svn <unfixed>
1765    
1766    libm (provided by libc)
1767            - spring <unfixed> (embed)
1768            NOTE: embedded by embedded copy of streflop
1769            - aide <unfixed> (static)
1770            - busybox <unfixed> (static)
1771            - mindi-busybox <unfixed> (static)
1772            - qemu <unfixed> (static)
1773            NOTE: qemu-user-static
1774            - tuxonice-userui <unfixed> (static)
1775            - zsh <unfixed> (static)
1776            NOTE: zsh-static
1777            - tripwire <unfixed>
1778    
1779    streflop
1780            - spring <unfixed> (embed)
1781    
1782  gzip:  minizip
1783  linux-kernel (lib/inflate.c)          - spring <unfixed> (embed)
 klibc (based on linux-kernel gzip code)  
 busybox  
1784    
1785  neon:  oscpack
1786  cadaver (all, but being worked on: #188381)          - spring <unfixed> (embed)
 gnome-vfs2 (#395874)  
 litmus (#395875)  
 screem (sarge only)  
 sitecopy (#395876)  
 tla (etch/sid only: #395877)  
1787    
1788  libmodplug:  hpiutil2
1789  gst-plugins-bad0.10          - spring <unfixed> (embed)
1790    
1791  libvncserver:  p7zip
1792  vino          - spring <unfixed> (embed)
1793    
1794  putty:  pythonqt (doesn't seem to be python-qtN, unknown source)
1795  filezilla          - fontmatrix <unfixed> (embed)
1796            - elmerfem <unfixed> (embed)
1797    
1798  tinyxml (not packaged in Debian):  iepngfix (not packaged in Debian; http://www.twinhelix.com/css/iepngfix/)
1799  filezilla          - docvert <unfixed> (embed)
1800            - jifty <unfixed> (embed)
1801            - kdenetwork <unfixed> (embed)
1802            - mediatomb <unfixed> (embed)
1803            - plastex <unfixed> (embed)
1804            - plone3 <removed> (embed)
1805            - python-chaco <unfixed> (embed)
1806            - python-docutils <unfixed> (embed)
1807            - s5 <unfixed> (embed)
1808            - zope2.10 <unfixed> (embed)
1809            - zope2.11 <removed> (embed)
1810            - cython <not-affcted> (embed)
1811            NOTE: part of documentation, which is not installed into the binary package
1812    
1813  gv:  python-docutils
1814  evince (ps/ tree from gv 3.5.8)          - zope2.10 <unfixed> (embed)
1815  evince-gtk (not packaged in Debian)          - zope2.11 <removed> (embed)
1816    
1817  libXbae:  tesseract
1818  libpawlib2-lesstif package (from Cernlib)          - ocropus <unfixed> (static)
1819    
1820  libXaw:  antlr
1821  libpawlib2-lesstif package (from Cernlib)          - kdevelop <unfixed> (embed)
1822    
1823  (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  libxerces2
1824            - openjdk-6 <unfixed> (embed)
1825    
1826  libgd2:  kfreebsd-8
1827  graphviz (lib/gd seems to be 2.0.33)          - kfreebsd-7 <unfixed> (old-version)
1828            - kfreebsd-6 <removed> (old-version)
1829    
1830  rar:  ruby1.9.1
1831  unrar-nonfree          - ruby1.9 <unfixed> (old-version)
1832            - ruby1.8 <unfixed> (old-version)
1833    
1834  unrar-free: (maybe this code is derived from the original rar, too?)  maildrop
1835  clamav (seems to be disabled in default config)          - courier <unfixed> (embed) [./maildrop]
1836    
1837  mplayer (DirectMedia Object loader):  glee
1838  xine-lib (src/libw32dll/)          - warzone2100 <not-affected> (embed)
 vlc (modules/codec/dmo/)  
1839    
1840  libwpd (WordPerfect converter):  phing
1841  openoffice.org          - symfony <unfixed> (embed)
1842    
1843  fsplib (http://sourceforge.net/projects/fsp/):  pake
1844  gftp (lib/fsplib version 0.3)          - symfony <unfixed> (embed)
1845    
1846  librpcsecgss:  propel
1847  krb5          - symfony <unfixed> (embed)
1848    
1849  jasper:  creole
1850  ghostscript          - symfony <unfixed> (embed)
 gs-gpl  
1851    
1852  libidn:  hfsutils
1853  monotone          - cdrkit <unfixed> (embed; bug #570187)
1854            NOTE: embeds hfsutils code in genisoimage
1855    
1856  liblua:  cdrkit
1857  monotone          - grub2 <unfixed> (embed; bug #570156)
1858            NOTE: genisoimage imported into grub-mkisofs
1859    
1860  libbotan:  kdebase-workspace
1861  montone          - kdebase <unfixed> (old-version)
1862    
1863  NetXX:  file
1864  monotone          - php5 <unfixable> (modified-embed)
1865            [lenny] - php5 <not-affected>
1866    
1867  libgc:  cdb
1868  mono          - php5 <unfixed> (embed)
1869    
1870  lzma:  libmbfl (itp: #570708)
1871  p7zip          - php5 <unfixed> (embed)
1872            NOTE: PHP is actually the current upstream, ITP is of that code
1873    
1874  lzo:  libonig
1875  grub2          - php5 5.3.2-1 (embed)
1876    
1877  pax code:  xmlrpc-epi
1878  tar          - php5 <unfixed> (embed)
1879  cpio  
1880    swt-gtk
1881            - eclipse <unfixed> (embed; bug #538808)
1882    
1883    txt2html
1884            - wml 2.0.11ds2-1 (embed)
1885    
1886    ca-certificates
1887            - nss <not-affected> (certificates are in source, but not included in any of the binary packages)
1888    
1889    openexr
1890            - freeimage <unfixed> (embed)
1891    
1892    libmng
1893            - freeimage <unfixed> (embed)
1894    
1895    openjpeg
1896            - freeimage <unfixed> (embed)
1897    
1898    libjpeg6b
1899            - freeimage <unfixed> (embed)
1900    
1901    libjpeg (don't know what exact version)
1902            - dcmtk <unfixed>
1903            - gdcm <unfixed>
1904            - insighttoolkit <unfixed>
1905            - openarena 0.8.5-5+exp1 (bug #495966)
1906            - outguess <unfixed>
1907            - squeak-vm <unfixed> (embed)
1908            - tremulous <unfixed>
1909            - tuxonice-userui <unfixed> (static)
1910            - fpc <unfixed> (static)
1911            - lazarus <unfixed> (static)
1912            NOTE: inherited from fpc, see #472304
1913            - mseide-msegui <unfixed> (static)
1914            NOTE: inherited from fpc, see #472304
1915            - easymp3gain <unfixed> (static)
1916            NOTE: inherited from fpc, see #472304
1917            - winff <unfixed> (static)
1918            NOTE: inherited from fpc, see #472304
1919            - texlive-bin <not-affected> (included in upstream source as dependency of libgd2, but not built or included in any of the binary packages)
1920    
1921    
1922    lxr
1923            - lxr-cvs <unfixed> (embed)
1924    
1925    libfile-copy-recursive-perl
1926            - r-base <unfixed> (embed; bug #577427)
1927            - r-base-core-ra <unfixed> (embed; bug #577429)
1928    
1929    delimmatch
1930            - r-base <unfixed> (embed; bug #577433)
1931            - r-base-core-ra <unfixed> (embed; bug #577434)
1932    
1933    libsmf (ITP: #572558)
1934            - denemo <unfixed> (embed)
1935            NOTE: http://lists.debian.org/debian-mentors/2010/04/msg00269.html
1936    
1937    libselinux
1938            - dpkg 1.15.6 (static)
1939    
1940    xinha (ITP: #479708)
1941            - horde3 <unfixed>
1942            - serendipity <unfixed>
1943            - openacs <unfixed>
1944            - dotlrn <unfixed>
1945    
1946    dvipng
1947            - texlive-bin <not-affected> (code present in source but not included in the binary packages)
1948    
1949    dvipdfmx
1950            - texlive-bin <unfixed> (embed)
1951            NOTE: this is intentionally part of the package now, and the separate dvipdfmx package has been removed from sid/squeeze
1952    
1953    lcdf-typetools
1954            - texlive-bin 2009-1 (embed)
1955    
1956    tex4ht
1957            - texlive-bin 2009-1 (embed)
1958    
1959    freetype
1960            - texlive-bin 2009-1 (embed)
1961    
1962    freetype2
1963            - texlive-bin 2009-1 (embed)
1964    
1965    silgraphite
1966            - texlive-bin <unfixed> (embed)
1967    
1968    unzip
1969            - texlive-bin 2009-1 (embed)
1970    
1971    jbig2dec
1972            - ghostscript 8.71~dfsg2-1 (embed)
1973    
1974    libxml2
1975            - chromium-browser 5.0.375.29~r46008-1
1976    
1977    protobuf
1978            - chromium-browser 5.0.375.70~r48679-2
1979    
1980    libv8
1981            - chromium-browser 5.0.375.38~r46659-1
1982    
1983    nspr
1984            - chromium-browser 5.0.375.29~r46008-3
1985    
1986    yasm
1987            - chromium-browser 5.0.375.29~r46008-2
1988    
1989    libxslt
1990            - chromium-browser 5.0.375.29~r46008-1
1991    
1992    miniupnpc (not packaged in Debian; ITP bug #444392)
1993            - warzone2100 <unfixed> (embed)
1994    
1995    iniparser (not packaged in Debian; RFP bug #582657)
1996            - warzone2100 <unfixed> (modified-embed)
1997    
1998    pyglet
1999            - sympy <unfixed> (embed; bug #459716)
2000    
2001    mpmath
2002            - sympy <unfixed> (embed; bug #541746)
2003    
2004  t1lib:  curl
2005  tetex-bin (links to system t1lib since 2.0.2)          - criticalmass <unfixed> (static; bug #599061)
2006  texlive-bin (links to system t1lib)          - wengophone 2.1.0~beta1-svn9983-1 (embed)
2007    
2008    lib3ds
2009            - boson <unfixed> (embed; bug #600900)
2010            - openscenegraph <unfixed> (embed; bug #601181)

Legend:
Removed from v.7700  
changed lines
  Added in v.15516

  ViewVC Help
Powered by ViewVC 1.1.5