/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 7700 by jmm-guest, Sun Dec 23 10:58:57 2007 UTC revision 15537 by silvio-guest, Fri Oct 29 04:31:39 2010 UTC
# Line 1  Line 1 
1  Embedded code copies  Embedded code copies
2  ====================  ====================
3    
4  This file collects cases, where a source package embeds code from  This file collects source packages that embed code from other projects.
5  other projects which is considered bad for fixing security flaws  This is considered bad for fixing security flaws because the fix needs
6  because the fix needs to be applied in multiple source packages.  to be applied in multiple source packages.
7    
8  Format:  Format:
9  <srcpkg> (<optional comment about srcpkg>)  <srcpkg> (<optional comment about srcpkg>)
10          - <embedding srcpkg> <status> (<sort>; bug #<number>)          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11          NOTE: optional comments about the linkage of the embedding srcpkg          NOTE: optional comments about the linkage of the embedding srcpkg
12    
13  status: version number fixing the embedded copy, <unfixed>, <removed> or <unknown> if the version number can not be determined  status: version number fixing the embedded copy
14  sort: static/dynamic          <unfixed> if the issue is not yet fixed
15            <removed> if the package was removed from the archive
16  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)          <itp> if the package is in the process of being packaged
17          - gpdf <removed>          <not-affected> if the package does not use the embedded copy
18          [sarge] - gpdf <unfixed>          <unknown> if the version number can not be determined
19          NOTE: has been replaced by evince in etch          <unfixable> for unavoidable cases (e.g., forks that add real value)
20    sort: static (linking statically against a lib)
21          embed (embeds a copy of the library into another source package)
22          modified-embed (embeds a code copy that differs from upstream code)
23          fork (a full-blown fork of another source package)
24          old-version (an older version of essentially the same code)
25    
26    The srcpkg might be some string to identify the code if there is no
27    specific source package.
28    
29    Everything up to the next line is ignored.
30    ---BEGIN
31    poppler
32          - pdftohtml <unknown>          - pdftohtml <unknown>
33          [sarge] - pdftohtml <unfixed>          [sarge] - pdftohtml <unfixed>
34          [etch] - pdftohtml <unfixed>          [etch] - pdftohtml <unfixed>
35          NOTE: has been replaced by poppler-utils          NOTE: has been replaced by poppler-utils
36          - kdegraphics <unfixed> (static; bug #436164)          - kdegraphics 4:4.2.2-1 (embed; bug #436164)
37          NOTE: the kpdf replacement in KDE 4 is using poppler          - texlive-base 3.0-12 (embed)
38          - tetex-bin 3.0-12 (dynamic)          - texlive-bin 2007-1 (embed)
39          NOTE: links to poppler          - koffice 1:2.0.0-1 (embed; bug #436163)
40          - texlive-bin <unknown> (dynamic)          - libextractor 0.5.12-1 (embed)
41          NOTE: links to poppler          NOTE: libextractor is using its own pdf decoder now
42          - koffice <unfixed> (static; bug #436163)          - ipe <unfixed> (embed)
         - libextractor 0.5.12-1 (static)  
         NOTE: libextractor is using its own pdf decoder  
         - libextractor 0.5.12-1 (dynamic)  
         NOTE: links to poppler  
         - pdfkit.framework 0.8-4 (dynamic)  
         NOTE: links to poppler  
         - ipe <unfixed> (static)  
43          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
44          - ruby-gnome2 <unknown> (dynamic)          - ruby-gnome2 <unknown> (embed)
45          NOTE: copy only present in source but links to poppler          - pdfedit <unfixed> (embed; bug #510794)
46            - swftools <removed> (embed; bug #551293)
47            - xpdf 3.02-9 (fork)
48    
49    pdksh (no longer developed since 1999)
50            - mksh <unfixable> (fork)
51            - posh <unfixable> (fork)
52    
53    ppmd
54            - libcomplearn-mod-ppmd <unfixed> (fork)
55            NOTE: discussion in #458152
56    
57    libevent
58            - transmission 1.71-1 (embed; bug #529372)
59            - chromium-browser 5.0.375.29~r46008-1
60            - dnsproxy <unknown> (embed)
61    
62    lrmi
63            - read-edid 2.0.0-1 (embed; bug #495131)
64            - s3switch <unfixed> (embed)
65            - xresprobe <unfixed> (embed)
66            - zhcon <unfixed> (embed)
67    
68    php-htmlpurifier
69            - mahara 1.2.5-1 (embed)
70            - knowledgeroot 0.9.9.5-5 (embed)
71            - moodle <unfixed> (embed)
72    
73    peercast
74            - gnome-peercast <removed> (embed)
75            [etch] - gnome-peercast <unfixed> (embed)
76    
77    silc-toolkit
78            - silc-client 1.1~beta6-1 (embed)
79    
80    icclib
81            - ghostscript <unfixed> (embed)
82            - argyll <unfixed> (embed)
83    
84    libusb
85            - argyll <unfixed> (embed)
86    
87    dietlibc
88            - ccontrol 0.9.1+20071204-1 (static)
89            - mksh <unfixable> (static)
90            NOTE: /bin/mksh-static only, and only on some arches (others use eglibc)
91    
92    libmikmod
93            - pysol-sound-server <unfixed> (modified-embed)
94            - sdl-mixer1.2 <unfixed> (embed)
95            TODO: report bug
96    
97    libiax
98            - iaxmodem <unfixable> (embed; bug #548885)
99    
100    spandsp
101            - iaxmodem <unfixable> (embed; bug #548885)
102    
103    python-paramiko
104            - fabric 0.9.0-2 (embed; bug #561398)
105    
106    zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
107            - dpkg 1.15.6 (static)
108            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
109            - rsync <unfixed> (embed)
110            - cherokee <unfixed> (embed)
111            NOTE: somehow derived code base
112            - mono <unfixed> (embed)
113            TODO: check mozilla
114            - Linux kernels <unfixed> (embed)
115            - pvpgn 1.7.8-2 (embed)
116            - mrtg 2.12.2-1 (embed)
117            - rpm <unknown> (embed)
118            NOTE: pinged anibal since when rpm was fixed
119            - tuxcmd-modules <unfixed> (embed)
120            - zsync <unfixed>
121            - tra <unfixed>
122            - sash <unfixed>
123            - nsis <unfixed>
124            - pyfits 1:2.3.1-1
125            - mseide-msegui <unfixed>
126            NOTE: mseide
127            - mirrordir <unfixed>
128            - poco <unfixed>
129            - klibc <unfixed>
130            - emboss <unfixed>
131            - ghostscript <unfixed>
132            - freeimage <unfixed>
133            - clamav <unfixed> (fork)
134            NOTE: from the changelog: "libclamav6 does indeed duplicate parts of the zlib code, but there is not way around that"
135            - tuxonice-userui <unfixed> (static)
136            - plt-scheme <unfixed>
137            - perl <unfixed>
138            - paraview <unfixed>
139            - velvet 0.7.56~nozlibcopy-1
140            - gcvs <unfixed>
141            - dump <unfixed>
142            - aide <unfixed> (static)
143            - dar <unfixed> (static)
144            - avfs <unfixed>
145            - fpc <unfixed>
146            - winff <unfixed>
147            NOTE: inherited from fpc, see #472304
148            - lazarus <unfixed>
149            NOTE: inherited from fpc, see #472304
150            - erlang <unfixed> (embed)
151            - gamera 3.2.3-1 (embed)
152            - python2.4 <unfixed> (embed; bug #553403)
153            - python2.5 <unfixed> (embed; bug #553403)
154            - texlive-bin <unknown> (embed)
155    
156    dulwich
157            - hg-git 0.1.0-1 (embed; bug #541996)
158    
159    libvigraimpex
160            - hugin <unfixed> (embed; bug #542259)
161            - enblend-enfuse <unfixed> (embed; bug #542258)
162            - gamera 3.2.3-1 (embed)
163    
164    libbz2
165            - dpkg 1.15.6 (static)
166            - amd64-libs <unfixed> (static)
167            NOTE: let's call it "static"
168            - dar <unfixed> (static)
169            - dump <unfixed> (static)
170            - unalz 0.64-1 (embed)
171            NOTE: has code, by the maint, to use the system version but links against the internal copy
172            - clamav <unfixed> (embed)
173            NOTE: libclamav/nsis/bzlib*
174            - pristine-tar <unfixable> (modified-embed)
175            NOTE: compression code only, not uncompression
176            - r-base-core-ra 1.2.8 (static)
177            - r-base-core 2.11.1 (static)
178            NOTE: links dynamically in squeeze, statically in lenny
179            - rpm <unfixed> (static)
180            NOTE: lsb-rpm package is statically linked, normal rpm links dynamically
181    
182    libyahoo2
183            - centerim <unfixed> (embed; bug #559783)
184    
185    libmsn
186            - centerim <unfixed> (embed; bug #559783)
187    
188    libgadu
189            - centerim <unfixed> (embed; bug #559783)
190            - pidgin <not-affected> (links dynamically since initial release; fixed in gaim)
191            - gaim 1:2.0.0+beta3-3 (embed; bug #360280)
192            - kdenetwork 4:3.3.2-5 (embed)
193            NOTE: from kdenetwork: kopete
194            - ekg 1:1.8~rc0-1 (embed)
195            - kadu 0.6.0.2-3 (embed; bug #504430)
196            - gadu <itp> (embed)
197    
198    xmlrpc (which package is the "origin" of this code?)
199            - drupal <unfixed> (embed)
200            - phpgroupware <unfixed> (embed)
201            - egroupware <unfixed> (embed)
202            - phpwiki <unfixed> (embed)
203            - php4 <removed> (embed)
204            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
205    
206    shtool (affects build-time only)
207            - mysql-ocaml <unfixed> (embed)
208            - php4 <removed> (embed)
209            - php5 <unfixed> (embed)
210    
211  silc-toolkit:  xulrunner
212  silc-client (uses libsilc and libsilcclient)          - iceape <unfixed> (embed; bug #561749)
213            - iceweasel 2.0.0.19 (embed)
214            - icedove <unfixed> (embed; bug #561750)
215            - kompozer <unfixed> (embed; bug #532168)
216            - galeon 2.0.2-4 (embed)
217            - epiphany-browser 2.14.3-8 (embed)
218            - conkeror 0.9~git080629-2 (embed)
219            - kazehakase 0.4.2-1 (embed)
220    
221    xli
222            - xloadimage <unfixed> (embed)
223    
224    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
225            - openmotif <unfixed> (embed)
226    
227    libxpm
228            - lesstif2 <unfixed> (embed; bug #575750)
229    
230    kerberized apps with BSD origin
231            - krb4 <removed> (embed)
232            - krb5 <unfixed> (embed)
233            - heimdal <unfixed> (embed)
234    
235    grip (which pkg is the origin?)
236            - libcdaudio <unfixed>
237            - grip <unfixed>
238            - gnome-vfs <unfixed>
239            TODO: check vfs2 as well
240    
241    fudforum
242            [etch] - phpgroupware <unfixed> (embed)
243            NOTE: phpgroupware-fudforum
244            [sarge] - egroupware-fudforum <removed> (embed)
245    
246    libbsd
247            - rdate 1:1.2-3 (embed)
248            - atheme-services <unfixed>
249            - libbsd-arc4random-perl <not-affected> (modified-embed)
250            NOTE: code not used, it links dynamically against libbsd instead
251            - isakmpd <unfixed>
252            - bsdgames <unfixed> (embed)
253            - bsd-mailx <unfixed> (embed)
254            - netcat-openbsd <unfixed> (embed; bug #550611)
255            - openssh <unfixed> (embed)
256            - unworkable <unfixed> (embed)
257            - mksh <unfixed> (modified-embed)
258            NOTE: strlcpy(), only used in /bin/mksh-static on eglibc arches
259            NOTE: FIXME, we should only have one entry: - mksh <not-affected> (modified-embed)
260            NOTE: strlcpy() on dietlibc arches; {g,s}etmode(); both unused
261    
262    cvs
263            - gcvs <unfixed> (embed)
264            NOTE: see cvsunix/src in tarball
265    
266    pcre3
267            - php4 <removed> (embed)
268            - analog 2:5.23-0woody1 (embed)
269            - goffice <unfixed> (embed)
270            NOTE: libgoffice-*
271            - vfu 4.06-4.1 (embed; bug #450754)
272            - tf5 5.0beta7-1 (embed)
273            - monotone 0.43-1 (embed)
274            NOTE: this only affects versions >= 0.37
275            - glib2.0 2.15.2-1 (embed)
276            - apache2 2.0.53-4 (embed)
277            - exim4 4.10-0.srh20.12 (embed)
278            - yacas <unfixed> (embed)
279            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
280            - gtamsanalyzer.app 0.42-5 (embed)
281            - tin 980117-1 (embed)
282            - kazehakase 0.5.2-1
283            - webkit 1.0.1-1 (embed)
284            - qt4-x11 <unfixed> (embed)
285            NOTE: embedded via webkit copy
286            - erlang <unfixed> (embed)
287            - ssed <unfixed> (embed)
288            - ircd-hybrid <unfixed> (static)
289            - emboss <unfixd>
290            - cherokee <unfixed> (embed)
291            - oftc-hybrid 1.6.9.dfsg-1 (embed)
292            - ratbox-services <unfixed> (embed)
293            - squeak-vm <unfixed> (embed)
294            - tinymux <unfixed> (embed)
295    
296    tiff
297            - wxwindows2.4 2.2.1 (embed)
298            - gamera 3.2.3-1 (embed)
299            - freeimage <unfixed> (embed)
300            - libtk-img <unfixed> (embed)
301            NOTE: there are two copies, one under tiff/ other under libtiff/
302            - gdal <unfixed>
303    
304    uudeview
305            - libconvert-uulib-perl <unfixed> (embed)
306            - pan <unfixed> (embed)
307    
308    sqlite (not affected by security vulnerabilities so far)
309            - amarok <unfixed> (embed)
310            - monotone 0.43-1 (embed)
311            - iceweasel <unfixed> (embed)
312            - heimdal <unfixed> (embed; bug #559616)
313    
314    util-linux/mount
315            - loop-aes-utils <unfixed> (embed)
316            NOTE: contains code from util-linux' mount in the mount-aes-udeb
317    
318    sylpheed
319            - sylpheed-claws <unfixed> (fork)
320    
321    phpsysinfo
322            - egroupware <unfixed> (embed)
323            - phpgroupware <unfixed> (embed)
324    
325    phpldapadmin
326            [sarge] - egroupware <unfixed> (embed)
327            NOTE: removed from egroupware after sarge
328    
329    chmlib
330            - kchmviewer <unknown> (embed)
331    
332    ffmpeg (libavcodec/libavformat)
333            - mplayer 1.0~rc2-14 (embed; bug #395252)
334            - kino 1.0.0-1
335            - vlc <not-affected> (Links dynamically since initial release)
336            - smilutils 0.3.0-10
337            NOTE: smilutils likely fixed earlier, marking Etch's version as fixed
338            - motion 3.1.19-1
339            - gstreamer0.10-ffmpeg 0.10.3-2
340            - xmovie <removed> (static)
341            TODO: gimp-gap (potentially using ffmpeg code as well)
342            - avifile 1:0.7.48~20090503.ds-1 (embed; bug #538750)
343            - audacity 1.3.7-2 (embed; bug #512278)
344            - chromium-browser <unfixed> (fork)
345    
346    faad2
347            - mplayer 1.0~rc2-20 (embed)
348            - avifile <unfixed> (embed; bug #538750)
349            - ffmpeg-debian <removed> (embed)
350    
351    libmad (MPEG decoding lib)
352            - xine-lib <unfixed> (embed)
353            - avifile 1:0.7.48~20090503.ds-1 (embed) [./plugins/libmad/*]
354            TODO: check ocaml-mad, madplay, pymad, xmms-mad, xmms2
355    
356  dietlibc:  libdts
357  ccontrol (linked statically until 0.9.1+20071204-1, affects Etch only)          - xine-lib <unfixed> (embed)
358    
359  libiax:  flac
360  iaxmodem          - xine-lib <unfixed> (embed)
   
 zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  
 dpkg  
 rsync (somehow derived code base)  
 mono  
 mozilla(?)  
 Linux kernels  
 pvpgn (links dynamically since 1.7.8-2)  
 mrtg (links dynamically since 2.12.2-1)  
 rpm  
361    
362  libbz2:  liba52
363  dpkg (statically linked)          - a52dec <unfixed> (embed)
364            - xine-lib <unfixed> (embed)
365    
366    mpeg2dec (libmpeg2)
367            - xine-lib <unfixed> (embed)
368    
369    libmpeg3
370            - squeak-vm <unfixed> (embed)
371    
372    libntlm
373            - wget <unfixed> (fork; bug #550436)
374            - curl <unfixed> (fork; bug #550437)
375            - cntlm <unfixed> (fork; bug #550438)
376    
377    uw-imap
378            - pine <unfixed> (embed)
379            - alpine <unfixed> (embed)
380    
381    imagemagick
382            - graphicsmagick <unfixed> (fork)
383    
384    python-urlgrabber
385            - mercurial <unfixed> (embed; bug #531062)
386            - w3af <unfixed> (embed; bug #555372)
387            [experimental] - harvestman <unfixed> (embed; bug #555373)
388    
389    beautifulsoup
390            - python-mechanize <unfixed> (embed; bug #555349)
391            - zope2.11 <removed> (embed; bug #555350)
392            - twill <unknown> (embed)
393    
394    halibut
395            - nsis <unfixed> (fork)
396    
397    libghttp
398            - hotway <unfixed> (embed)
399    
400    libsndfile
401            - ardour 1:2.7.1-1 (embed)
402    
403    glibmm2.4
404            - ardour 1:2.7.1-1 (embed)
405    
406    libgnomecanvasmm2.6
407            - ardour 1:2.7.1-1 (embed)
408    
409    libsigc++-2.0
410            - ardour 1:2.7.1-1 (embed)
411    
412    soundtouch
413            - ardour 1:2.7.1-1 (embed)
414    
415    libmms
416            - xine-lib <unfixed> (embed)
417            - mimms <unfixed> (embed)
418    
419    fckeditor
420            - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
421            - moin 1.8.2-2 (embed; bug #452599)
422            - karrigell <removed> (embed; bug #452598)
423            - gforge 4.6.99+svn6225-1 (embed)
424            - request-tracker3.8 <unfixed> (embed)
425            - otrs2 <unfixed> (embed)
426    
427    ipatlas (not packaged in Debian)
428            - moodle <unfixed> (embed; bug #507185)
429    
430    libphp-phpmailer
431            - moodle <unfixed> (embed; bug #507185)
432            - mahara <unfixed> (embed)
433            - symfony <unfixed> (embed; bug #566778)
434            [etch] - phpgroupware <unfixed> (embed)
435            NOTE: phpgroupware-felamimail is only in etch
436            - egroupware <unfixed> (embed; bug #504283)
437            - glpi <unfixed>
438    
439    htmlArea (not packaged in Debian)
440            - moodle <unfixed> (embed)
441    
442    giflib
443            - wine <unfixed> (embed; bug #466181)
444    
445    bennu (not packaged in Debian, http://bennu.sourceforge.net)
446            - moodle <unfixed> (embed)
447    
448    smarty
449            - moodle 1.8.2-2 (embed; bug #471158)
450            - gallery2 2.2.5-2 (embed; bug #471160)
451            - mahara 0.9.2-2 (embed; bug #471201)
452            - gosa 2.4beta1-1 (embed; bug #471200)
453    
454    TinyMCE
455            - wordpress 2.5.1-3 (embed; bug #478257)
456            - moodle <unfixed> (embed; bug #507185)
457            - knowledgeroot <unfixed> (embed)
458            - joomla <itp> (bug #326398)
459            - mahara 1.2.6-1 (embed; #597752)
460    
461    scintilla (upstream provides static lib, rejected shared lib http://sf.net/support/tracker.php?aid=2488121)
462            - scite <unfixed> (embed)
463            - qscintilla <unfixed> (embed)
464            - qscintilla2 <unfixed> (embed)
465            - geany <unfixed> (fork)
466            - anjuta <unfixed> (embed)
467    
468    libphp-adodb
469            - moodle <unfixed> (embed; bug #507185)
470            NOTE: also AdoDB-XML Schema
471            - gallery2 <unfixed> (embed)
472            - phppgadmin <unfixed> (embed)
473            - egroupware <unfixed> (embed)
474            - phpwiki <unfixed> (embed)
475            - torrentflux 2.0beta1-2 (embed)
476            - ipplan <unfixed> (embed)
477            - typo3-src <unfixed> (embed)
478            - cacti <unknown> (embed)
479            [sarge] - cacti <unfixed> (embed)
480            NOTE: dependency exists, but internal version is used
481            - gforge 4.7~rc2-6 (embed)
482            - mahara <unfixed> (embed)
483    
484    gzip
485            - linux-2.6 <unfixed> (embed) [lib/inflate.c]
486            - klibc <unfixed> (embed)
487            NOTE: based on linux-kernel gzip code
488            - busybox <unfixed> (embed)
489            - pristine-tar <unfixed> (modified-embed)
490            NOTE: compression code only, not uncompression
491            - ncompress <unfixed> (old-version)
492    
493    neon
494            - cadaver 0.22.3+debian-1 (embed; bug #188381)
495            - gnome-vfs2 <unfixed> (embed; bug #395874)
496            [etch] - litmus <unfixed> (embed; #395875)
497            - litmus <removed> (embed; #395875)
498            [sarge] - screem <unfixed> (embed)
499            - sitecopy 1:0.16.0-1 (embed; bug #395876)
500            [etch] - tla <unfixed> (embed; bug #395877)
501            [sarge] - tla <unfixed> (embed; bug #395877)
502    
503    libmodplug
504            - gst-plugins-bad0.10 0.10.10.2-1 (embed)
505    
506    libvncserver
507            - vino <unfixed> (embed)
508    
509    putty
510            - filezilla <unfixed> (embed)
511    
512    tinyxml (not packaged in Debian; itp bug #531968)
513            - filezilla <unfixed>
514            - crystalspace <unfixed> (embed)
515            - libwfut <unfixed> (embed)
516            - rarian <unfixed> (embed)
517            - bulletml <unfixed> (embed)
518            - pokerth <unfixed> (embed)
519            - qutecom <unfixed> (embed)
520            - sofa-framework <unfixed> (embed)
521            - yate <unfixed> (embed)
522            - antigrav <unfixed> (embed)
523            - balder2d <unfixed> (embed)
524            - cal3d <unfixed> (embed)
525            - criticalmass <unfixed> (embed)
526            - ember <unfixed> (embed)
527            - epiphany <unfixed> (embed)
528            - gambit <unfixed> (embed)
529            - noiz2sa <unfixed> (embed)
530            - ogre <unfixed> (embed)
531            - opencity <unfixed> (embed)
532            - openmovieeditor <unfixed> (embed)
533            - pouetchess <unfixed> (embed)
534            - tecnoballz <unfixed> (embed)
535            - trigger-rally <unfixed> (embed)
536            - xmoto <unfixed> (embed)
537            - mapnik <unknown> (embed)
538            NOTE: uses a different XML parser by default
539            - rrootage 0.23a-6 <embed>
540            NOTE: links to libbulltetml
541            - boson <unknown> (embed)
542            NOTE: the embedded code is unused
543    
544    gv
545            - evince <unfixed> (embed)
546            NOTE: ps/ tree from gv 3.5.8
547            NOTE: evince-gtk is affected (a component of evince source package)
548    
549    libXbae
550            - paw <unfixed> (embed)
551    
552    libgtkhtml
553            - claws-mail-extra-plugins <unfixed> (fork)
554    
555    libXaw
556            - paw <unfixed> (embed)
557            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
558    
559    libgd2
560            - graphviz <unfixed> (embed)
561            NOTE: lib/gd seems to be 2.0.33
562            - wml 2.0.11ds2-1 (embed)
563            - libwmf <unfixed> (embed)
564            NOTE: derived from gd 1.6.3
565            - plt-scheme <unfixed> (embed; bug #601525)
566            - texlive-bin 2009-1 (embed)
567    
568    rar
569            - unrar-nonfree <unfixed> (embed)
570    
571    unrar-free (maybe this code is derived from the original rar, too?)
572            - clamav <unfixed> (embed)
573            NOTE: seems to be disabled in default config
574    
575    mplayer (DirectMedia Object loader)
576            - xine-lib <unfixed> (embed)
577            NOTE: src/libw32dll/
578            - vlc <unfixed> (embed)
579            NOTE: modules/codec/dmo/
580            - mplayer 1.0~rc2-20 (embed)
581    
582    libwpd (WordPerfect converter)
583            - openoffice.org <unfixed> (embed)
584    
585    fsplib (http://sourceforge.net/projects/fsp/)
586            - gftp <unfixed> (embed)
587            NOTE: lib/fsplib version 0.3
588    
589    sprng
590            - tree-puzzle <unfixed> (embed)
591    
592    librpcsecgss
593            - krb5 <unfixed> (embed)
594    
595    jasper
596            - ghostscript 8.64~dfsg-2 (embed)
597    
598    libiris
599            - psi <unfixed> (embed)
600            - kdenetwork <unfixed> (embed)
601            NOTE: kopete embeds libiris but links dynamically to libidn
602            - kdegames <unfixed> (embed)
603            NOTE: ksirk/kde4
604    
605    libidn
606            - monotone 0.43-1 (embed)
607            - psi <unfixed> (embed)
608            NOTE: psi embeds libiris which embeds libidn
609            - kdegames <unfixed> (embed)
610            NOTE: kdegames/kde4 embeds libiris which embeds libidn
611    
612    lua5.1
613            - monotone 0.43-1 (embed)
614            - nmap 5.00-1 (embed; bug #527997)
615            [lenny] - nmap <unfixed> (embed; bug #527997)
616            - ocropus <unfixed> (embed)
617            - enigma <unfixed> (embed)
618            NOTE: requires lua built with C++
619            - freeciv <unfixed> (embed)
620            - spring <unfixed> (embed)
621    
622    libbotan
623            - monotone 0.43-1 (embed)
624    
625    NetXX
626            - monotone 0.43-1 (embed)
627    
628    libgc
629            - mono <unfixed> (embed)
630    
631    lzma
632            - p7zip <unfixed> (embed)
633            - xz-utils <unfixed> (fork)
634            - r-base <unfixed> (embed)
635            NOTE: lzma support not yet in lenny or in r-base-core-ra 1.2.8
636    
637    lzo
638            - grub2 <unfixed> (embed)
639    
640    yassl
641            - mysql-dfsg-5.0 <unfixed> (embed)
642            - mysql-5.1 <unfixed> (embed)
643    
644    pax code
645            - tar <unfixed> (embed)
646            - cpio <unfixed> (embed)
647    
648    t1lib
649            - tetex-bin 2.0.2-1 (embed)
650            - texlive-bin <unknown> (embed)
651            - grace 5.1.14-2 (embed)
652            NOTE: Might be fixed even earlier
653    
654    guichan
655            - boswars <unfixed> (embed)
656            NOTE: maintainer notified us, working on it
657    
658    tolua
659            - boswars <unfixed> (embed)
660            NOTE: maintainer notified us, working on it
661            NOTE: actually tolua++
662            - ocropus <unfixed> (embed)
663            NOTE: actually tolua++
664            - freeciv <unfixed> (embed)
665            NOTE: actually tolua++
666            - enigma <unfixed> (embed)
667    
668    asio-dev
669            - luxrender <removed> (embed)
670    
671    xine-lib
672            - vlc <unfixed> (embed)
673            NOTE: only parts included in modules/access/rtsp
674    
675    netpbm
676            - tcl8.3 <unfixed> (embed)
677            - tcl8.4 <unfixed> (embed)
678            - tcl8.5 <unfixed> (embed)
679            NOTE: generic/tkImgGIF.c
680    
681    tk8.5
682            - tk8.0 <removed> (old-version)
683            - tk8.3 <unfixed> (old-version)
684            - tk8.4 <unfixed> (old-version)
685            - perl-tk <unfixable> (fork)
686    
687    samba
688            - mc 2:4.6.2~git20080311-1 (embed)
689            NOTE: maintainer is aware of this, currently searching a solution
690    
691    plib1.8.4c2
692            - boson <unfixed> (fork)
693            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
694    
695    fribidi
696            - quesoglc 0.7.2-2 (embed)
697    
698    glew
699            - quesoglc <unfixed> (embed; bug #489341)
700            NOTE: waiting on GLEW_MX version of glew (see bug #474488)
701            - trigger 0.5.2.1-2 (embed)
702            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
703            - trigger-rally 0.5.2.1-2 (embed)
704            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
705            - chromium-browser 5.0.375.70~r48679-2
706    
707    minorGems (pabs contacted upstream about shared lib, he considers minorGems an 'ever-evolving collection of reusable code fragments' for his own use)
708            - transcend <unfixed> (embed)
709            - cultivation <unfixed> (embed)
710            - passage <unfixed> (embed)
711            - gravitation <unfixed> (embed)
712    
713    tar
714            - libarchive <unfixed> (embed)
715            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
716    
717    cpio
718            - libarchive <unfixed> (embed)
719            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
720    
721    kde4libs
722            - kdelibs <unfixable> (old-version)
723    
724    webkit
725            - qt4-x11 <unfixed> (embed; bug #479851)
726            [etch] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
727            - kde4libs <unfixable> (fork)
728            NOTE: kde4lib's khtml and webkit were forked from khtml (this tracking, which seems
729            NOTE: reversed genesis-wise, is used because of so much other stuff in kde4libs)
730            - chromium-browser <unfixed> (fork)
731    
732    ftgl
733            - blender 2.46+dfsg-1 (embed)
734    
735    wv
736            - abiword <unfixed>
737    
738    qemu
739            - kvm <removed> (embed; bug #543159)
740            - qemu-kvm <unfixed> (embed; bug #560853)
741            NOTE: kvm superceded by qemu-kvm, which is just user interface (no modules)
742            - xen-3 3.4.2-2 (embed; bug #560856)
743            - xen-unstable <unfixed> (embed; bug #560856)
744    
745    vgabios
746            - kvm <removed> (embed; bug #489442)
747            - qemu-kvm <unfixed> (embed)
748    
749    bochs
750            - kvm <removed> (embed; bug #489442)
751            - qemu-kvm <unfixed> (embed)
752    
753    speex
754            - vorbis-tools <unfixed> (embed)
755            NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
756            - gst-plugins-good0.10 <unfixed> (embed)
757            - xine-lib <unfixed> (embed)
758            - libfishsound <unfixed> (embed)
759            - libannodex <removed> (embed)
760            - opal 3.4.2~dfsg-2 (embed)
761            - mumble 1.2.0~beta1-1 (embed)
762            - vlc <unfixed> (embed)
763            - xmms-speex <unfixed> (embed)
764            - libsdl-sound1.2 <unfixed> (embed)
765            - sweep <unfixed> (embed)
766    
767    libreadline
768            - magic <itp> (old-version)
769    
770    opcode
771            - ode <unfixed> (embed)
772            NOTE: opcode is not a package in debian, it is just embedded
773            NOTE: http://www.codercorner.com/Opcode.htm
774    
775    gimpact
776            - ode <unfixed> (embed)
777            NOTE: gimpact is not a package in debian, it is just embedded
778            NOTE: http://gimpact.sf.net
779    
780    mochikit
781            - mahara <unfixed> (embed)
782            NOTE: they require extra patches, still unmerged upstream
783            - ntop <unfixed> (embed)
784            - coherence 0.6.2-1 (embed)
785            - paste <unfixed> (embed)
786            - turbogears <unfixed> (embed)
787            - plone3 <removed> (embed)
788            - xulrunner <unfixed> (embed)
789            - libjifty-plugin-chart-perl <unfixed> (embed)
790            - sabnzbdplus <unfixed> (embed)
791            - tgmochikit <unfixed> (embed)
792    
793    prototypejs
794            - netbeans-ide 6.0.1+dfsg-2 (embed)
795            - auth2db 0.2.5-2+dfsg-1 (embed; bug #555218)
796            - webcit <unfixed> (embed; bug #555219)
797            - asterisk 1:1.6.2.0~rc3-1 (embed)
798            - libjson-ruby 1.1.4-1 (embed; bug #555224)
799            - lucene2 2.9.1+ds1-2 (embed; bug #555226)
800            - horde3 <unfixed> (embed)
801            - knowledgeroot 0.9.8.5-4 (embed; bug #555230)
802            - mediatomb 0.12.0~svn2018-5 (embed; bug #555233)
803            - mt-daapd 0.9~r1696.dfsg-6lenny2 (embed)
804            - ebug-http <unfixed> (embed; bug #555236)
805            - libaws 2.7-1 (embed; bug #555222)
806            - phpgedview <removed> (embed)
807            - poker-network 1.7.6-1 (embed; bug #555238)
808            - rails 2.1.0-6 (embed)
809            - wordpress 2.5.0-2 (embed; bug #555243)
810            - zope <not-affected> (the prototypejs embed is not in any of the obvious zope packages, e.g. zope2.9, zope2.10, zope2.11, and zope3)
811            TODO: search through all of the other zope packages
812            - ampache 3.4.1-2 (embed)
813            - exaile 0.2.14+debian-2.1 (embed; bug #555245)
814            - hobix 0.5~svn20070319-4 (embed; bug #555247)
815            - zabbix 1.6.6-4 (embed; bug #555250)
816            - chora2 2.1.1+debian0-1 (embed; bug #555253)
817            - gollem 1.1.1+debian0-1 (embed; bug # 555254)
818            - jscropperui 1.2.1-1 (embed; bug #555257)
819            - scriptaculous <not-affected> (uses system prototype.js since initial upload; bug #555260)
820            - ingo1 1.2.3+debian0-1 (embed; bug #555261)
821            - kronolith2 2.3.3+debian0-1 (embed; bug #555262)
822            - activeldap 1.2.1-1 (embed)
823            - libv8 <not-affected> (contains a google-specific implementation of prototype.js)
824            - mantis 1.1.2+dfsg-1 (embed; bug #555265)
825            - otrs2 2.3.4-6 (embed; bug #555267)
826            - webcalendar 1.2~b1-2 (embed; bug #555269)
827            - redmine 0.9.0~svn2907-1 (embed; bug #555270)
828            - jifty 0.90519-1 (embed; bug #555271)
829            - jquery 1.4-1 (embed; bug #555272)
830            - passenger 2.2.5debian1-1 (embed; bug #555273)
831            - plone3 <removed> (embed; bug #555275)
832            - wesnoth <not-affected> (prototype.js not included in any of the binary packages; bug #555277)
833            - libhtml-prototype-perl 1.48-3 (embed; bug #538920)
834            - xulrunner <unfixed> (embed)
835            NOTE: included in iceweasel/xulrunner unit tests directory, so may not be security-relevant
836            - jclicmoodle <unfixed> (embed)
837            - git-cola <unfixed> (embed)
838    
839    gdb
840            - insight <unfixed> (embed)
841    
842    e2fsprogs
843            - ldiskfsprogs <unfixable> (fork)
844    
845    quazip (not packaged in Debian)
846            - qcake <unfixed> (embed)
847            NOTE: starting with upstream version 0.6.4
848    
849    exo
850            - pcmanfm <unfixed> (embed; bug #499677)
851            NOTE: slightly modified source code
852    
853    java
854            - openjdk-6 <unfixed>
855            - sun-java5 <unfixed>
856            - sun-java6 <unfixed>
857    
858    libphp-snoopy
859            - ampache 3.4.1-2 (embed; bug #504169)
860            - gforge 4.6.99+svn6094-2 (embed)
861            - mahara 1.0.5-2 (embed; bug #504170)
862            - pixelpost 1.7.1-5 (embed; bug #504171)
863            - mediamate 0.9.3.6-5 (embed; bug #504172)
864            - opendb <removed> (embed; bug #504173)
865            [etch] - opendb <unfixed> (embed; bug #504173)
866            - wordpress 2.5.1-9 (embed; bug #443948)
867            - moodle <unfixed> (embed; bug #507185)
868            [etch] - phpgroupware <unfixed> (embed)
869            NOTE: phpgroupware-felamimail
870            - magpierss 0.72-3 (embed; bug #431089)
871    
872    jquery
873            - zekr <unfixed> (embed)
874            - wordpress <unknown> (embed)
875            - yocto-reader <unfixed> (embed)
876            - textpattern <unfixed> (embed)
877            - genshi 0.5.1-1 (embed)
878            NOTE: compressed file under examples/ dir
879            - prewikka <unfixed> (embed)
880            - libramaze-ruby <unfixed> (embed)
881            - drupal6 <unfixed> (embed)
882            - b2evolution <unfixed> (embed)
883            - wesnoth <unfixed> (embed)
884    
885    tablesorter (jquery plugin, not packaged yet)
886            - wesnoth <unfixed> (embed)
887    
888    kses
889            - wordpress <unfixed> (embed; bug #504242)
890            NOTE: their copy has all methods renamed to wp_<foo>
891            NOTE: kses isn't in Debian, RFP: #504240
892            - moodle <unfixed> (embed; bug #507185)
893            - egroupware <unfixed> (embed)
894    
895    magpierss
896            - wordpress <unfixed> (embed; bug #504242)
897            - moodle <unfixed>
898    
899    php-gettext
900            - wordpress 2.8.4-1 (embed; bug #504242)
901            - docbookwiki <unfixed> (embed)
902            - knowledgeroot 0.9.9.5-1
903            NOTE: non-free
904    
905    libphp-ixr (name may change, it is the Incutio XML-RPC)
906            - wordpress <unfixed> (embed; bug #504242)
907            NOTE: libphp-ixr isn't in Debian, RFP: #504236
908            - dokuwiki <unfixed> (embed)
909            - textpattern <unfixed> (embed)
910    
911    libphp-cas
912            - glpi <unfixed> (embed)
913            - moodle <unfixed> (embed; bug #505984)
914    
915    scriptaculous (prototype.js is among the embeds in the following)
916            - glpi <unfixed> (embed)
917            - libaws <unfixed> (embed; bug #555222)
918            - op-panel <unfixed> (embed)
919            - symfony <unfixed> (embed)
920            NOTE: maintainer says there are extra incompatible changes required
921            - pixelpost 1.7.1-6 (embed)
922            - webhelpers <unfixed> (embed)
923            - qwik <removed> (embed; bug #555241)
924            - smokeping <unfixed> (embed)
925            - turba2 <unfixed> (embed)
926            - typo3-src 4.2.3-1 (embed)
927            - request-tracker3.6 <unfixed> (embed)
928            - request-tracker3.8 <unfixed> (embed)
929            - rt-extension-emailcompletion <not-affected> (prototype.js not included in the binary package)
930            - wordpress 2.5.0-2 (embed)
931            - libhtml-prototype-perl 1.48-3 (embed)
932    
933    libmarkdown-php
934            - moodle <unfixed> (embed; bug #507185)
935            - pixelpost 1.7.1-6 (embed)
936    
937    php-openid
938            - wordpress-openid 3.3.2-1 (embed)
939    
940    geshi
941            - dokuwiki 0.0.20080505-3.1 (embed)
942            - pgfouine 1.0-1.1 (embed)
943            - websvn 2.1.0-1 (embed)
944    
945    webcalendar
946            - gforge 4.7~rc2-6 (embed; bug #504758)
947    
948    libical
949            - kdepim <unknown> (fork)
950            NOTE: fixed at some point during 4.0
951            - kdepimlibs 4.2.0-1 (fork)
952            - claws-mail-extra-plugins <unfixed> (fork)
953    
954    harfbuzz
955            - qt4-x11 <unfixed> (embed)
956            - pango1.0 <unfixed> (embed)
957            - fontmatrix <unfixed> (embed)
958    
959    libzip
960            - php5 <unfixable> (modified-embed)
961            - odt2txt <unfixed> (embed; bug #523808)
962    
963    json.php (not packaged; should be replaced with php's built-in functions)
964            - moodle <unfixed>
965            - yui <unfixed>
966            - gallery2 <unfixed>
967            - dokuwiki <unfixed>
968            - typo3-src <unfixed>
969    
970    php-fpdf
971            - tcpdf <itp> (fork)
972            - moodle <unfixed>
973            - phpwiki <unfixed>
974            - egroupware <unfixed>
975            - ldap-account-manager <unfixed> (fork)
976    
977    tcpdf (itp: #495985)
978            - moodle <unfixed>
979            - phpmyadmin <unfixed>
980    
981    typo3
982            - moodle <unfixed>
983    
984    spreadsheet_writeexcel (PHP port of libspreadsheet-writeexcel-perl; itp: #487557)
985            - moodle <unfixed>
986            - gosa <unfixed>
987    
988    php-ole (itp: #487558)
989            - moodle <unfixed>
990    
991    pieforms (http://www.catalyst.net.nz)
992            - mahara <unfixed>
993    
994    savant2 (http://phpsavant.com)
995            - egroupware <unfixed>
996    
997    rssparser (http://nwow.org)
998            - egroupware <unfixed>
999            - phpgroupware <unfixed>
1000    
1001    lcms
1002            - openjdk-6 <unfixed> (fork)
1003            - gimp 2.4.0~rc2-2
1004    
1005    libphp-phplayersmenu
1006            - diogenes <unfixed>
1007            - phpldapadmin <unfixed>
1008    
1009    libphp-pclzip
1010            - docvert <unfixed>
1011            - moodle <unfixed>
1012            - egroupware <unfixed>
1013    
1014    libphp-simplepie
1015            - dokuwiki <unfixed>
1016            - wordpress <unfixed>
1017    
1018    libphp-jpgraph
1019            - egroupware <unfixed>
1020    
1021    php-simpletest
1022            - moodle <unfixed>
1023    
1024    libpng
1025            - doxygen <unknown> (embed)
1026            - gdal <unknown> (embed)
1027            - iceweasel <not-affected> (uses xulrunner)
1028            - icedove 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1, 2.0.0.19-1 (embed)
1029            - iceape 1.0.13~pre080614i-0etch1 (embed)
1030            - libfltk1.1 <unknown> (embed)
1031            - libtk-img <unfixed> (embed)
1032            - htmldoc <unknown> (embed)
1033            - xulrunner 1.9.0.13-1 (embed)
1034            [lenny] - xulrunner 1.9.0.11-0lenny1
1035            [etch] - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
1036            - gamera 3.2.3-1 (embed)
1037            - freeimage <unfixed> (embed)
1038            - syslinux-common <unfixable> (embed)
1039            - tuxonice-userui <unfixed> (static)
1040            - texlive-bin <unknown> (embed)
1041            - vice <unknown> (embed)
1042            - VisualBoyAdvance <unknown> (embed)
1043    
1044    irssi
1045            - silc-client <unfixed> (embed)
1046            NOTE: Seems to be a pre-0.8.12 version that is used in irssi-plugin-silc
1047    
1048    extc
1049            - mtasc <unfixed> (embed)
1050            - haxe <unfixed> (embed)
1051    
1052    swflib
1053            - mtasc <unfixed> (embed)
1054            - haxe <unfixed> (embed)
1055    
1056    libitext-java
1057            - bouncycastle 2.1.4-1 (embed)
1058    
1059    python-ply
1060            - pyke <unfixed> (embed; bug #555363)
1061            - pywbem 0.7.0-4 (embed; bug #555364)
1062            - sepolgen <unfixed> (embed; bug #555365)
1063            - zope-textindexng3 <unknown> (embed)
1064            - iceweasel <not-affected> (uses xulrunner)
1065            - xulrunner <unknown> (embed)
1066            - wireshark <not-affected> (python-ply modules are not installed into binary packages; see #554613)
1067    
1068    libdumbnet (libdnet upstream)
1069            - nmap <unfixed> (fork)
1070    
1071    gcc-4.4
1072            - gcc-mingw32 <unfixed> (embed)
1073    
1074    camlimages
1075            - advi <unfixed> (static; bug #550441)
1076    
1077    memcached
1078            - memcachedb <unfixed> (embed)
1079    
1080    yajl
1081            - argyll <unfixed> (embed; bug #544223)
1082            NOTE: reference, confirmed by build logs: http://lists.debian.org/debian-mentors/2009/08/msg00062.html
1083    
1084    nusoap
1085            - gforge 4.8.2-1 (embed)
1086            - ampache <unfixed> (embed)
1087            - poker-network <unfixed> (embed)
1088            - moodle <unfixed> (embed)
1089            NOTE: code is not used when running under php5 and soap is enabled
1090            - phpwiki <unfixed> (embed)
1091            - gallery2 <unfixed> (embed)
1092            - typo3-src <unfixed> (embed)
1093            - phpgacl 3.3.7-7 (embed)
1094            - mantis 1.1.8+dfsg-1 (embed)
1095    
1096    libept
1097            - adept <unfixed> (embed; bug #540649)
1098    
1099    libvorbis
1100            - iceweasel <not-affected> (uses xulrunner)
1101            - xulrunner <unfixed> (embed; bug #540959)
1102            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1103            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1104            - iceape <unfixed> (embed)
1105            [etch] - iceape <not-affected> (introduced in 2.0)
1106            [lenny] - iceape <not-affected> (introduced in 2.0)
1107    
1108    cairo
1109            - iceweasel <not-affected> (uses xulrunner)
1110            - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
1111    
1112    liboggz
1113            - iceweasel <not-affected> (uses xulrunner)
1114            - xulrunner <unfixed> (embed; bug #540959)
1115            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1116            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1117            - iceape <unfixed> (embed)
1118            [etch] - iceape <not-affected> (introduced in 2.0)
1119            [lenny] - iceape <not-affected> (introduced in 2.0)
1120    
1121    liboggplay
1122            - iceweasel <not-affected> (uses xulrunner)
1123            - xulrunner <unfixed> (embed; bug #540959)
1124            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1125            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1126            - iceape <unfixed> (embed)
1127            [etch] - iceape <not-affected> (introduced in 2.0)
1128            [lenny] - iceape <not-affected> (introduced in 2.0)
1129    
1130    php-net-dnsbl
1131            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1132    
1133    php-onyx-rss
1134            - serendipity <unfixed> (embed; bug #541740; wontfix: only one script, own package is overkill, appears not to be duplicated in Debian)
1135    
1136    php-text-wiki
1137            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1138    
1139    php-xml-rpc
1140            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1141    
1142    polarssl (does not have a shared library)
1143            - pdkim <itp> (embed; bug #543150)
1144            - xyssl <unfixed> (old-version)
1145    
1146    pidgin (libpurple)
1147            - gaim <removed> (old-version)
1148            - qutecom 2.2~rc3.hg396~dfsg1-6 (embed; bug #559785)
1149    
1150    icu
1151            - webkit 1.0.1-1 (embed; bug #547214)
1152            - texlive-bin <unfixed> (fork)
1153            NOTE: texlive upstream working with icu upstream to merge their changes
1154            - chromium-browser 5.0.375.29~r46008-3
1155    
1156    cyrus-imapd-2.2
1157            - kolab-cyrus-imapd <unfixed> (fork)
1158            - dovecot 1:1.2.1-1 (embed) [/dovecot-sieve/src/libsieve/*]
1159    
1160    python-cxx-dev
1161            - freecad 0.9.2646.3-1 (embed; bug #547936)
1162    
1163    zipios++
1164            - freecad 0.9.2646.3-1 (embed; bug #547941)
1165            - enigma 0.92.3-3 (embed)
1166            NOTE: likely fixed earlier, marking etch's version as fixed
1167    
1168    linux-2.6
1169            - kvm <removed> (embed; bug #549973) [./kernel/*]
1170            - linux-kbuild-2.6 <unfixed> (embed; bug #550379) [./kbuild/*]
1171            - kernel-source-2.6.8 <removed> (old-version)
1172            - kernel-source-2.4.27 <removed> (old-version)
1173            - kernel-source-2.4.24 <removed> (old-version)
1174            - kernel-source-2.2.25 <removed> (old-version)
1175            - kernel-source-2.2.20 <removed> (old-version)
1176    
1177    libfdt (not yet packaged separately for debian; http://www.jdl.com/software/)
1178            - kvm <removed> (embed) [./libfdt/*]
1179            - qemu-kvm <unfixed> (embed) [./libfdt/*]
1180    
1181    qweb (not packaged)
1182            - ajaxterm <unfixed>
1183    
1184    opensaml2
1185            - opensaml <removed> (old-version)
1186    
1187    shibboleth-sp2
1188            - shibboleth-sp <removed> (old-version)
1189    
1190    tuxonice-userui
1191            - suspend2-userui <removed> (old-version)
1192    
1193    expat
1194            - w3c-libwww <removed> (embed; bug #551941)
1195            [etch] - w3c-libwww <unfixed> (embed; bug #551941) [./modules/expat/*]
1196            - python-xml <unfixed> (embed; bug #551940) [./extensions/expat/*]
1197            - python2.5 <unfixable> (embed; bug #553403) [./Modules/expat/*]
1198            - python2.4 <unfixable> (embed; bug #553403)
1199            - python2.7 2.7-6 (embed)
1200            - mcabber 0.10.0-1 (low; bug #601053)
1201            - python-4suite <unfixed> (embed; bug #516935)
1202            - wxwindows2.4 <removed> (embed)
1203            - wxwidgets2.6 2.6.3.2.2-4 (embed)
1204            - wxwidgets2.8 2.8.10.1-2 (embed)
1205            - albert <unfixed> (embed; bug #600974)
1206            - celementtree 1.0.5-8 (embed)
1207            NOTE: Maybe that was fixed even earlier
1208            - centerim <unfixed> (embed; bug #559783)
1209            - audacity 1.3.2-1 (embed)
1210            - matanza <unfixed> (embed)
1211            - tdom 0.8.3~20080525-1 (embed)
1212            - udunits 2.1.8-4 (embed)
1213            - apr-util 1.2 (embed)
1214            - ayttm <unfxed> (embed; bug #561006)
1215            - cableswig <unfixed> (embed)
1216            - cadaver <unfixed> (embed)
1217            - cmake 2.6.0-6 (embed)
1218            - coin3 <unfixed> (embed)
1219            - cvsnt <unknown> (embed)
1220            - dasher <unknown> (embed)
1221            - gdcm 2.0.14-2 (embed)
1222            - ghostscript 8.71~dfsg-2 (embed)
1223            - grmonitor <removed> (embed)
1224            - iceape <unfixed> (embed)
1225            - insighttoolkit 3.16.0-1 (embed)
1226            NOTE: insighttoolkit might've been fixed earlier
1227            - jabber <unknown> (embed)
1228            - libparagui1.1 1.0.2-1 (embed)
1229            - libspiff <unknown> (embed)
1230            - mcabber <unfixed> (embed; bug #601053)
1231            - paraview 3.6.2-1 (embed)
1232            - poco 1.3.6p1-1 (embed)
1233            - scorched3d <unknown> (embed)
1234            - simgear <unfixed> (embed)
1235            - sitecopy 1:0.16.0-1
1236            - smart <unfixed> (embed)
1237            NOTE: smart embeds celementree, and it includes expat
1238            - swish-e <not-affected> (Linked against libxml, which is used instead)
1239            - tla 1.3.5+dfsg-15 (embed)
1240            - vtk 4.1.20030227-1 (embed)
1241            - wbxml2 <not-affected> (expat code is only used on Mac OS X, see #560941)
1242            - xmlrpc-c <unfixed> (embed)
1243            - iceweasel <unfixed> (embed)
1244            - kompozer <unfixed> (embed)
1245            - vxl 1.13.0-2 (embed)
1246            - xulrunner <unfixed> (embed)
1247            - xmame <unknown> (embed)
1248            - apache2 2.2 (embed)
1249            - texlive-bin <not-affected> (Embedded code not compiled in)
1250            - vnc4 <unfixed> (embed)
1251            - xotcl 1.6.6-1 (embed)
1252            - chromium-browser 5.0.375.29~r46008-3
1253    
1254    xerces-c
1255            - xerces-c2 <unfixed> (old-version)
1256            - xerces27 <removed> (old-version)
1257    
1258    md5 (RSA's version; not the gnu version provided by coreutils)
1259            - w3c-libwww <removed> (embed; bug #551942)
1260            [etch] - w3c-libwww <unfixed> (embed; bug #551942) [./modules/md5/*]
1261    
1262    libparagui1.1
1263            - asc <unfixable> (fork)
1264    
1265    enet
1266            - sauerbraten <unfixed> (embed; #497194)
1267    
1268    eglibc
1269            - glibc <removed> (old-version)
1270            - mksh <unfixable> (static)
1271              NOTE: /bin/mksh-static only, and only on some arches (others use dietlibc)
1272    
1273    galib
1274            - gamera 3.2.3-1 (embed)
1275    
1276    configobj
1277            - bzr 2.1.0~rc2-1 (embed; bug #555336)
1278            - elisa <unfixed> (embed; bug #555337)
1279            - gaupol <unfixed> (embed; bug #555338)
1280            - ipython <unfixed> (embed; bug #555339)
1281            - pida <unfixed> (embed; bug #555340)
1282            - psychopy <unfixed> (embed; bug #555341)
1283            - rest2web <unfixed> (embed; bug #555342)
1284            - auth2db <unknown> (embed)
1285            - dynagen <unknown> (embed)
1286            - iceweasel <unknown> (embed)
1287            - sabnzbdplus <unknown> (embed)
1288            - xulrunner <unknown> (embed)
1289            - nipy <not-affected> (part of an example [/examples/neurospin/neurospy/configobj.py], which is not installed into binary packages)
1290    
1291    python-clientform
1292            - bibus <unfixed> (embed; bug #555332)
1293            - zope2.10 <unfixed> (embed; bug #555333)
1294            - zope2.11 <removed> (embed; bug #555334)
1295            - python-mechanize <unknown> (embed)
1296            - twill <unknown> (embed)
1297    
1298    python-mechanize
1299            - zope2.10 <unfixed> (embed; bug #555337)
1300            - zope2.11 <removed> (embed; bug #555338)
1301            - twill <unknown> (embed; bug #555339)
1302    
1303    pexpect
1304            - duplicity 0.6.06-1 (embed; bug #555361)
1305            - hplip <unfixed> (embed; bug #555362)
1306            - smart <unfixed> (embed; bug #555363)
1307    
1308    pyparsing
1309            - bauble <unfixed> (embed; bug #555366)
1310            - boa-constructor 0.6.1-8 (embed; bug #555367)
1311            - calibre <unfixed> (embed; bug #555368)
1312            - matplotlib <unfixed> (embed; bug #531024)
1313            - zhpy 1.7.3.1-1 (embed; bug #555370)
1314            - polybori <unknown> (embed)
1315            - python-whoosh <unknown> (embed)
1316            - twill <unknown> (embed)
1317            - zope-textindexng3 <unknown> (embed)
1318    
1319    python-pysqlite2
1320            - python2.4 <unfixed> (embed; bug #553403)
1321            - python2.5 <unfixed> (embed; bug #553403)
1322    
1323    celementtree
1324            - python2.5 <unfixed> (embed)
1325            - smart <unfixed> (embed)
1326    
1327    elementtree
1328            - python2.5 <unfixed> (embed)
1329            - python2.6 <unfixed> (embed)
1330            - bzr 2.1.0~rc2-1 (embed; bug #555343)
1331            - gedit 2.28.2-1 (embed; bug #555344)
1332            - smart <unfixed> (embed)
1333            - solfege <unfixed> (embed; bug #555345)
1334            - w3af <unfixed> (embed; bug #555346)
1335            - python-qt4 <unknown> (embed)
1336            - sphinx <unknown> (embed)
1337            - python-nltk <itp> (embed)
1338    
1339    python2.5
1340            - python2.4 <unfixed> (old-version)
1341            - jython <unfixed> (embed)
1342            NOTE: embeds many stdlib modules
1343            - python-django <unfixed> (embed; bug #555419)
1344            NOTE: embeds stdlib modules: doctest, decimal
1345            - gamera 3.2.3-1 (embed)
1346            NOTE: embeds stdlib modules: ConfigParser, optparse, sets, textwrap
1347            - boa-constructor <unfixed> (embed; bug #555426)
1348            NOTE: embeds stdlib modules: ConfigParser, tarfile, zipfile, xmlrpclib
1349            - nicotine <unfixed> (embed; bug #555427)
1350            NOTE: embeds stdlib modules: ConfigParser
1351            - museek+ <unfixed> (embed; bug #555428)
1352            NOTE: embeds stdlib modules: ConfigParser
1353            - vegastrike-data <removed> (embed)
1354            NOTE: embeds many stdlib modules
1355            - codespeak-lib 1.1.1-1 (embed; bug #555420)
1356            NOTE: embeds stdlib modules: doctest, optparse, subprocess, textwrap
1357            - config-manager <unfixed> (embed; bug #555423)
1358            NOTE: embeds stdlib modules: optparse
1359            - jhbuild 2.28.0-1 (embed; bug #555421)
1360            NOTE: embeds stdlib modules: optparse, subprocess
1361            - smart <unfixed> (embed; bug #555432)
1362            NOTE: embeds stdlib modules: optparse
1363            - pyprotocols 1.0a.svn20070625-5 (embed; bug #555433)
1364            NOTE: embeds stdlib modules: doctest
1365            - ruledispatch 0.5a.svn20080510-4 (embed; bug #555434)
1366            NOTE: embeds stdlib modules: doctest
1367            - distribute <unfixed> (embed)
1368            NOTE: embeds stdlib modules: doctest
1369            - python-setuptools <unfixed> (embed; bug #555435)
1370            NOTE: embeds stdlib modules: doctest
1371            - zope.testing <unfixed> (embed; bug #555436)
1372            NOTE: embeds stdlib modules: doctest
1373            - translate-toolkit <unfixed> (embed; bug #555422)
1374            NOTE: embeds stdlib modules: textwrap, contextlib
1375            - libtpclient-py <unfixed> (embed; bug #555424)
1376            NOTE: embeds stdlib modules: subprocess
1377            - grass <unfixed> (embed; bug #555425)
1378            NOTE: embeds stdlib modules: subprocess
1379            - coherence <unfixed> (embed; bug #555429)
1380            NOTE: embeds stdlib modules: uuid
1381            - python-django-extensions 0.4.2pre+git200911182050-1 (embed; bug #555430)
1382            NOTE: embeds stdlib modules: uuid
1383            - setroubleshoot <removed> (embed; bug #555431)
1384            NOTE: embeds stdlib modules: uuid
1385            - linkchecker <unfixed> (embed; bug #555414)
1386            NOTE: embeds msgfmt.py script
1387            - imdbpy <unfixed> (embed)
1388            NOTE: embeds msgfmt.py script
1389            - kiwi <unfixed> (embed)
1390            NOTE: embeds msgfmt.py script
1391            - moin <unfixed> (embed)
1392            NOTE: embeds msgfmt.py script, stdlib modules: cgitb, difflib, tarfile
1393            - plone3 <removed> (embed)
1394            NOTE: embeds msgfmt.py script
1395            - roundup <unfixed> (embed)
1396            NOTE: embeds msgfmt.py script, stdlib modules: cgitb
1397            - rednotebook <unfixed> (embed; bug #555415)
1398            NOTE: embeds msgfmt.py script
1399            - turbogears <unfixed> (embed)
1400            NOTE: embeds msgfmt.py script
1401            - elisa <unfixed> (embed)
1402            NOTE: embeds msgfmt.py script, stdlib modules: uuid
1403            - calibre <unfixed> (embed)
1404            NOTE: embeds msgfmt.py script, stdlib modules: zipfile
1405            - mailman 1:2.1.13-1 (embed; #555416)
1406            NOTE: embeds msgfmt.py script
1407            - python-docutils <unknown> (embed)
1408            NOTE: embeds stdlib modules: optparse, textwrap
1409            - python-imaging <unknown> (embed)
1410            NOTE: embeds stdlib modules: doctest
1411            - python-mechanize <unknown> (embed)
1412            NOTE: embeds stdlib modules: doctest
1413            - twill <unknown> (embed)
1414            NOTE: embeds stdlib modules: subprocess
1415            - zeroc-ice <unknown> (embed)
1416            NOTE: embeds stdlib modules: subprocess
1417            - wxwidgets2.8 <unknown> (embed)
1418            NOTE: embeds stdlib modules: subprocess
1419            - cycle <unknown> (embed)
1420            NOTE: embeds msgfmt.py script
1421            - deluge <unknown> (embed)
1422            NOTE: embeds msgfmt.py script
1423            - opendict <unknown> (embed)
1424            NOTE: embeds msgfmt.py script
1425            - openerp-client <unknown> (embed)
1426            NOTE: embeds msgfmt.py script
1427            - rapidsvn <unknown> (embed)
1428            NOTE: embeds msgfmt.py script
1429            - wammu <unknown> (embed)
1430            NOTE: embeds msgfmt.py script
1431            - gaphor <unknown> (embed)
1432            NOTE: embeds msgfmt.py script
1433            - pida <unknown> (embed)
1434            NOTE: embeds msgfmt.py script
1435            - python-formencode <unknown> (embed)
1436            NOTE: embeds msgfmt.py script
1437            - duplicity <unfixed> (embed)
1438            NOTE: embeds stdlib module: urlparse, tarfile
1439            - pygopherd <unfixed> (embed)
1440            NOTE: embeds stdlib module: zipfile
1441    
1442    argparse
1443            - twill <unfixed> (embed; bug #555347)
1444            - ipython <unfixed> (embed; bug #555348)
1445    
1446    coherence
1447            - elisa <unfixed> (embed; bug #555335)
1448    
1449    simpletal
1450            - plastex <unfixed> (embed; bug #555371)
1451    
1452    flickrpc (not packaged in Debian, http://burtonini.com/bzr/flickrpc/)
1453            - postr <unfixed> (embed)
1454            - elisa <unfixed> (embed)
1455    
1456    simplegeneric (not packaged in Debian, http://pypi.python.org/pypi/simplegeneric)
1457            - apertium-tolk <unfixed> (embed)
1458            - ipython <unfixed> (embed)
1459            - virtaal <unfixed> (embed)
1460    
1461    distribute
1462            - setuptools <removed> (old-version)
1463    
1464    rails
1465            - jruby1.2 <removed> (embed) [./bench/rails/*]
1466            NOTE: jruby is in non-free, it probably includes rails too
1467            - libgettext-ruby <unfixed> (embed) [./samples/rails/*]
1468            - libopenid-ruby <unfixed> (embed) [./examples/rails_openid/*]
1469            - thin <unfixed> (embed) [./spec/rails_app/*]
1470            NOTE: this is a subdirectory of examples, which in general is a non-issue, but may
1471            NOTE: be dangerous if developers are naively basing their code off of the examples
1472            NOTE: prototype.js is among the example files
1473    
1474    lucene2 (prototype.js is among the embeds in the following)
1475            - lucene <unfixed> (old-version)
1476            - pylucene <unfixed> (embed)
1477            - libpdfbox-java <unfixed> (embed)
1478            - libfontbox-java <unfixed> (embed)
1479            - libjempbox-java <unfixed> (embed)
1480            - solr <unfixed> (embed)
1481    
1482    unicode-data
1483            - syslinux <unfixed> (embed)
1484            - camomile <unfixed> (embed)
1485            - fribidi <unfixed> (embed)
1486            - m17n-db <unfixed> (embed)
1487            - sbcl <unfixed> (embed)
1488            - heimdal <unfixed> (embed)
1489            - icu <unfixed> (embed)
1490            - icu4j <unfixed> (embed)
1491            - krb5 <unfixed> (embed)
1492            - moodle <unfixed> (embed)
1493            - openldap <unfixed> (embed)
1494            - pike7.6 <unfixed> (embed)
1495            - samba <unfixed> (embed)
1496            - samba4 <unfixed> (embed)
1497            - cmucl <unfixed> (embed)
1498            - typo3-src <unfixed> (embed)
1499            - mauve <unfixed> (embed)
1500            - texlive-bin <unfixed> (embed)
1501            - ypsilon <unfixed> (embed)
1502            - jeuclid <unfixed> (embed)
1503            - charmap.app <unfixed> (embed)
1504            - clisp <unfixed> (embed)
1505            - gnulib <unfixed> (embed)
1506            - opensrs-client <unfixed> (embed)
1507            - saxonb <unfixed> (embed)
1508            - rails <unfixed> (embed)
1509    
1510    feedparser
1511            - rawdog <unfixed> (embed; bug #383422)
1512            - miro <unfixed> (embed; bug #555351)
1513            - calibre <unfixed> (embed; bug #555352)
1514            - freevo <unfixed> (embed; bug #555353)
1515            - pida <unfixed> (embed; bug #555354)
1516            - planet-venus <unfixed> (embed; bug #555355)
1517            - plone3 <removed> (embed; bug #555356)
1518            - exaile 0.2.14+debian-1 (embed)
1519            - screenlets 0.1.2-3 (embed)
1520            NOTE: included twice
1521    
1522    agg:
1523            - matplotlib <unfixed> (embed: bug #377271)
1524            - contextfree <unfixed> (embed)
1525            NOTE: since 2.2-1 it links statically to system libagg, but still uses the embedded copy
1526            - exactimage <unfixed> (embed)
1527            - python-enable <unfixed> (embed)
1528            - mapnik 0.5.1-3 (embed)
1529            NOTE: links statically to agg, but shared library is not available (bug #377271)
1530    
1531    vtk
1532            - paraview <unfixable> (embed; bug #495426)
1533    
1534    txt2tags
1535            - rednotebook <unfixed> (embed)
1536    
1537    htmltextview (not packaged in Debian, http://www.gnome.org/~gjc/htmltextview.py)
1538            - gajim <unfixed> (embed)
1539            - emesene <unfixed> (embed)
1540            - convirt <unfixed> (embed)
1541            - pida <unfixed> (embed)
1542            - rednotebook <unfixed> (embed)
1543    
1544    horde3 (prototype.js is among the embeds in the following)
1545            - mnemo2 <unfixed> (embed)
1546            - nag2 <unfixed> (embed)
1547            - wordpress <unfixed> (embed)
1548            NOTE: Text_Diff (wp-includes/Text/Diff*)
1549    
1550    cimg
1551            - gmic <unfixed> (embed)
1552    
1553    mootools
1554            - kdenetwork <unfixed> (embed)
1555            - gallery <unfixed> (embed)
1556            - jspwiki <unfixed> (embed)
1557            - vdr-plugin-live <unfixed> (embed)
1558            - perl-doc-html <unfixed> (embed)
1559    
1560    openldap
1561            - openldap2.3 <removed> (old-version)
1562    
1563    grub2
1564            - grub <unfixed> (old-version)
1565    
1566    gnupginterface
1567            - duplicity <unfixed> (embed)
1568    
1569    python-dateutil
1570            - awn-extras-applets <unfixed> (embed)
1571            - matplotlib <unknown> (embed)
1572    
1573    cups
1574            - cupsys <removed> (old-version)
1575    
1576    yui
1577            - bcfg2 <not-affected> (present in source but not included in any binary files)
1578            - serendipity 1.5.3-1 (embed; bug #557746)
1579            - moodle 1.8.2.dfsg-5 (embed)
1580            - jifty 0.91117-1 (embed; bug #557748)
1581            - webgui 7.7.26-1 (embed)
1582            - loggerhead 1.17-1 (embed)
1583            - otrs2 2.4.7+dfsg1-1 (embed; bug #592146)
1584    
1585    quake3 (vanilla source not packaged in debian)
1586            - openarena <unfixable> (fork)
1587    
1588    quake2 (vanilla source not packaged in debian)
1589            - alien-arena <unfixable> (fork)
1590            - warsow <unfixable> (fork)
1591    
1592    libtheora
1593            - iceweasel <not-affected> (uses xulrunner)
1594            - xulrunner <unfixed> (embed; bug #540959)
1595            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1596            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1597            - iceape <unfixed> (embed; bug #559276)
1598            [etch] - iceape <not-affected> (introduced in iceape 2.0)
1599            [lenny] - iceape <not-affected> (introduced in iceape 2.0)
1600    
1601    dtoa
1602            - bfilter <unfixed> (embed)
1603            - cacao <removed> (embed)
1604            - cdrdao <unfixed> (embed)
1605            - classpath <unfixed> (embed)
1606            - freej <unfixed> (embed)
1607            - iceape <unfixed> (embed)
1608            - iceweasel <unfixed> (embed)
1609            - jscoverage <unfixed> (embed)
1610            - kde4libs <unfixed> (embed)
1611            - kdelibs <unfixed> (embed)
1612            - kompozer <unfixed> (embed)
1613            - libv8 <unfixed> (embed)
1614            - mono <unfixed> (embed)
1615            - newlib <unfixed> (embed)
1616            - nspr <unfixed> (embed)
1617            - php5 <unfixed> (embed)
1618            - polyml <unfixed> (embed)
1619            - qt4-x11 <unfixed> (embed)
1620            - rhino <unfixed> (embed)
1621            NOTE: code translated to Java
1622            - ruby1.8 <unfixed> (embed)
1623            - ruby1.9 <unfixed> (embed)
1624            - ruby1.9.1 <unfixed> (embed)
1625            - sdd <unfixed> (embed)
1626            - sfind <unfixed> (embed)
1627            - star <unfixed> (embed)
1628            - tinymux <unfixed> (embed)
1629            - virtualbox-ose <unfixed> (embed)
1630            - webkit <unfixed> (embed)
1631            - xulrunner <unfixed> (embed)
1632    
1633    ipc (not packaged in Debian; see http://mozdev.org/pipermail/enigmail/2009-November/011678.html)
1634            - firegpg <unfixed> (embed)
1635            - enigmail <unfixed> (embed)
1636    
1637    ptmalloc (not packaged in Debian)
1638            - crystalspace <unfixed> (embed)
1639            - qt4-x11 <unfixed> (embed)
1640    
1641    svgalib
1642            - usplash <unfixed> (embed)
1643    
1644    bogl
1645            - usplash <unfixed> (embed)
1646    
1647    taglist
1648            - usplash <unfixed> (embed)
1649    
1650    portaudio
1651            - audacity <unfixed> (embed; bug #323711)
1652    
1653    nyquist
1654            - audacity <unfixed> (embed)
1655            NOTE: embeds a forked nyquist with support for a shared library
1656    
1657    vamp-plugin-sdk
1658            - audacity <unfixed> (embed)
1659    
1660    wordpress
1661            - libwordpress-xmlrpc-perl <removed> (embed) [./xmlrpc.php]
1662            - wordpress-mu <removed> (fork)
1663    
1664    php5
1665            - php4 <removed> (old-version)
1666    
1667    classpath
1668            - libgnucrypto-java <removed> (embed; bug #559788)
1669    
1670    libtool
1671            - apr <unfixed> (static; bug #489625)
1672            NOTE: ships copy of libtool in libapr1-dev; was 'embed' before 1.3.2-3
1673            - arts <unfixed> (embed)
1674            - bochs 2.4.2-1 (embed; bug #560884)
1675            - camserv <unfixed> (embed)
1676            - collectd 4.8.2-1 (embed)
1677            - courier-authlib 0.58-4 (embed)
1678            NOTE: The etch version of courier-authlib was the earliest version checked, might be fixed earlier
1679            - cvsnt 2.5.04.3236-1.2 (embed)
1680            - dico <not-affected> (Uses the system copy of ltdl)
1681            - freeradius 0.1+20010527-1 (embed)
1682            NOTE: Earliest reference I could find from the changelog is from 27 May 2001
1683            - ggobi 2.1.9~20091212-1 (embed)
1684            - glame 2.0.1-4 (embed)
1685            NOTE: The etch version of glame was the earliest version checked, might be fixed earlier
1686            - gnash 0.8.7-2 (embed)
1687            - gnu-smalltalk <unfixed> (embed; bug #566777)
1688            - google-gadgets 0.10.5-0.3 (embed)
1689            NOTE: 0.10.5-0.3 was the earliest version checked, was fixed earlier
1690            - graphicsmagick 1.3.5-6 (embed)
1691            - graphviz 2.8-3 (embed)
1692            NOTE: The etch version of graphviz was the earliest version checked, might be fixed earlier
1693            - guile-1.6 1.6.8-7 (embed)
1694            - hamlib 1.2.11-1 (embed)
1695            - hercules 3.06-1.2 (embed)
1696            - jags 1.0.4-3 (embed; bug #560864)
1697            - kdelibs <unfixed> (embed)
1698            - libannodex <removed> (embed)
1699            - libextractor 0.5.23+dfsg-4 (embed)
1700            - libmcrypt <not-affected> (libtool source present but not included in any of the binary packages)
1701            - libtunepimp 0.5.3-7.3 (embed)
1702            - mp4h 1.3.1-4.1 (embed)
1703            - naim <removed> (embed)
1704            - parser-mysql <unfixed> (embed)
1705            - pinball 0.3.1-11 (embed)
1706            - redland <unfixed> (embed)
1707            - siproxd <unfixed> (embed)
1708            - ski <unfixed> (embed)
1709            - synfig 0.62.00-1 (embed)
1710            - unixodbc 2.2.4-5 (embed)
1711            - xmlsec1 <not-affected> (Doesn't enable dynamic loading of crypto modules)
1712            - clamav 0.95+dfsg-1 (embed)
1713            - imagemagick 6:6.2.3.1-1 (embed)
1714            - hypre 2.4.0b-5 (embed)
1715            - lam <unfixed> (embed)
1716            - openmpi <unfixable> (embed; bug #559386)
1717            - parser <unfixed> (embed)
1718            - pdsh 2.18-5 (embed; bug #560892)
1719            - sbnc 1.2-8 (embed)
1720            - sdcc <unfixed> (embed)
1721            - wml <not-affected> (The embedded ltdl isn't used, instead mp4h is used, see 559841)
1722            - proftpd-dfsg <unfixed> (embed; bug #561748)
1723            - babel 1.4.0.dfsg-5 (embed)
1724            - libprelude 0.9.14-2 (embed)
1725            - heartbeat 2.1.4-7 (embed)
1726            NOTE: From Squeeze onwards the system copy of ltdl is used, use the current version from Squeeze,
1727            NOTE: might've been fixed earlier
1728            - gcc-* <unknown> (embed)
1729    
1730    ocamlgsl
1731            - orpie 1.5.1-7.1 (embed; bug #550058)
1732    
1733    xdotool
1734            - keynav <unfixed> (embed; bug #560103)
1735    
1736    bulletphysics (not packaged; http://www.bulletphysics.org/)
1737            - supertuxkart <unfixed> (embed)
1738            - blender <unfixed> (embed)
1739    
1740    ghostscript
1741            - gs-gpl <removed> (old-version)
1742    
 libgadu/ekg:  
 centericq  
 gaim  
 pigdin (links dynamically against libgadu)  
 kopete (ships the code, but links dynamically in the Debian package)  
 kadu (not packaged in Debian)  
 GNU gadu (not yet packaged in Debian)  
   
 xmlrpc: (which package is the "origin" of this code?)  
 drupal  
 phpgroupware  
 egroupware  
 phpwiki  
 php4 (php-pear, IIRC this was reorganized some weeks ago?)  
   
 shtool: (affects build-time only)  
 mysql-ocaml  
 php4  
   
 mozilla:  
 mozilla-firefox  
 mozilla-thunderbird  
 firefox (to be removed)  
 thunderbird (to be removed)  
 iceweasel  
 iceape  
1743  icedove  icedove
1744  xulrunner          - thunderbird <removed> (old-version)
 nvu (no longer in Debian)  
1745    
1746  xli:  sizzlejs (not packaged in Debian, http://sizzlejs.com/)
1747  xloadimage          - jquery <unfixed> (embed)
1748    
1749  lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)  sed
1750  openmotif          - ssed <unfixed> (fork)
 xfree86/xorg (in libxpm)  
   
 kerberized apps with BSD origin:  
 krb4  
 krb5  
 heimdal  
   
 grip: (which pkg is the origin?)  
 libcdaudio  
 grip  
 gnome-vfs (vfs2 as well?)  
   
 fudforum:  
 phpgroupware-fudforum  
 egroupware-fudforum (removed from egroupware after sarge)  
   
 cvs:  
 gcvs (at least an additional script is included, check if there's more)  
   
 pcre:  
 all pythons  
 php4 (src included, but Debian package links dynamically)  
 analog (src included, but Debian package links dynamically)  
 libgoffice-1  
 vfu (removed linking against embedded copy in 4.06-4.1; #450754)  
 tf5 (since 5.0beta7 the Debian package links dynamically)  
 monotone (including this starting from 0.37)  
 glib (2.14 series for gregex support, only for udeb, regular packag links dynamic)  
 apache2 (since 2.0.53-4 uses 040_link_external_pcre patch)  
 exim4 (since 4.10-0.srh20.12 uses 36_pcre patch to use external pcre)  
 yacas (<= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway)  
 gtamsanalyzer.app (links dynamically since 0.42-5)  
   
 tiff:  
 wxpythongtk (check, which debian pkg this is in)  
 older kdegraphics/kpdf releases < 3.3 embedded a copy  
   
 uudeview:  
 libconvert-uulib-perl  
   
 sqlite: (not affected by security vulnerabilities so far)  
 amarok  
 monotone  
 iceweasel  
   
 util-linux/mount:  
 loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb  
   
 webmin:  
 usermin (only in sarge)  
   
 sylpheed:  
 sylpheed-claws  
   
 phpsysinfo:  
 egroupware  
 phpgroupware  
   
 phpldapadmin:  
 egroupware (removed from egroupware after sarge)  
   
 chmlib:  
 kchmviewer (ships the code but links dynamically)  
   
 libavcodec/libavformat (source: ffmpeg):  
 mplayer (#395252)  
 xvidcap  
 kino (links statically, does not include code)  
 vlc (links statically, does not include code)  
 smilutils (links statically, does not include code)  
 motion (links statically, does not include code)  
 gst-ffmpeg  
 gstreamer0.10-ffmpeg  
 xmovie  
1751    
1752  mad MPEG decoding lib:  phpatomlib (http://code.google.com/p/phpatomlib)
1753  mad          - wordpress <unfixed> (embed)
1754  xine-lib  
1755    Services_JSON (http://pear.php.net/package/Services_JSON)
1756            - wordpress <unfixed> (embed)
1757    
1758    phpass (http://www.openwall.com/phpass/)
1759            - gallery2 <unfixed> (embed)
1760            - wordpress <unfixed> (embed)
1761            - typo3-src <unfixed> (modified-embed)
1762            NOTE: file refers to drupal, maybe there's a copy somewhere there
1763            NOTE: a copyright owner search didn't match anything
1764            - libauthen-passphrase-perl <unfixable> (fork)
1765            NOTE: perl implementation of phpass
1766    
1767    squirrelmail
1768            - wordpress <unfixed> (embed)
1769            NOTE: class-pop3.php
1770    
1771    ezSQL (http://www.woyano.com/jv/ezsql)
1772            - wordpress <unfixable> (fork)
1773            NOTE: wp-db.php
1774    
1775    Diff.php (Clay Loveless' version/killersoft.com)
1776            - php-versioncontrol-svn <unfixed>
1777    
1778    libm (provided by libc)
1779            - spring <unfixed> (embed)
1780            NOTE: embedded by embedded copy of streflop
1781            - aide <unfixed> (static)
1782            - busybox <unfixed> (static)
1783            - mindi-busybox <unfixed> (static)
1784            - qemu <unfixed> (static)
1785            NOTE: qemu-user-static
1786            - tuxonice-userui <unfixed> (static)
1787            - zsh <unfixed> (static)
1788            NOTE: zsh-static
1789            - tripwire <unfixed>
1790    
1791    streflop
1792            - spring <unfixed> (embed)
1793    
1794  libdts:  minizip
1795  libdts          - spring <unfixed> (embed)
 xine-lib  
1796    
1797  flac:  oscpack
1798  flac          - spring <unfixed> (embed)
 xine-lib  
1799    
1800  liba52:  hpiutil2
1801  a52dec          - spring <unfixed> (embed)
 xine-lib  
1802    
1803  libmpeg2:  p7zip
1804  mpeg2dec          - spring <unfixed> (embed)
 xine-lib  
1805    
1806  curl:  pythonqt (doesn't seem to be python-qtN, unknown source)
1807  wget (code for NTLM authentication)          - fontmatrix <unfixed> (embed)
1808            - elmerfem <unfixed> (embed)
1809    
1810  TODO evaluate:  iepngfix (not packaged in Debian; http://www.twinhelix.com/css/iepngfix/)
1811  gimp-gap (potentially using ffmpeg code as well)          - docvert <unfixed> (embed)
1812            - jifty <unfixed> (embed)
1813            - kdenetwork <unfixed> (embed)
1814            - mediatomb <unfixed> (embed)
1815            - plastex <unfixed> (embed)
1816            - plone3 <removed> (embed)
1817            - python-chaco <unfixed> (embed)
1818            - python-docutils <unfixed> (embed)
1819            - s5 <unfixed> (embed)
1820            - zope2.10 <unfixed> (embed)
1821            - zope2.11 <removed> (embed)
1822            - cython <not-affcted> (embed)
1823            NOTE: part of documentation, which is not installed into the binary package
1824    
1825  uw-imap:  python-docutils
1826  pine          - zope2.10 <unfixed> (embed)
1827  alpine          - zope2.11 <removed> (embed)
1828    
1829  imagemagick:  tesseract
1830  graphicsmagick          - ocropus <unfixed> (static)
1831    
1832  halibut:  antlr
1833  nsis          - kdevelop <unfixed> (embed)
1834    
1835  libghttp:  libxerces2
1836  hotway          - openjdk-6 <unfixed> (embed)
1837    
1838  libsndfile:  kfreebsd-8
1839  ardour          - kfreebsd-7 <unfixed> (old-version)
1840            - kfreebsd-6 <removed> (old-version)
1841    
1842  glibmm2.4:  ruby1.9.1
1843  ardour          - ruby1.9 <unfixed> (old-version)
1844            - ruby1.8 <unfixed> (old-version)
1845    
1846  libgnomecanvasmm2.6:  maildrop
1847  ardour          - courier <unfixed> (embed) [./maildrop]
1848    
1849  libsigc++-2.0:  glee
1850  ardour          - warzone2100 <not-affected> (embed)
1851    
1852  soundtouch:  phing
1853  ardour          - symfony <unfixed> (embed)
1854    
1855  libmms:  pake
1856  xine-lib          - symfony <unfixed> (embed)
 mimms  
1857    
1858  FCKeditor: (packaged as fckeditor)  propel
1859  knowledgeroot          - symfony <unfixed> (embed)
 moin (452599)  
 karrigell (452598)  
 gforge-plugins-extra (fixed since 4.6.99+svn6225-1)  
1860    
1861    creole
1862            - symfony <unfixed> (embed)
1863    
1864    hfsutils
1865            - cdrkit <unfixed> (embed; bug #570187)
1866            NOTE: embeds hfsutils code in genisoimage
1867    
1868  Moodle contains lots of things:  cdrkit
1869  AdoDB          - grub2 <unfixed> (embed; bug #570156)
1870  AdoDB-XML Schema          NOTE: genisoimage imported into grub-mkisofs
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
 TinyMCE  
 bennu  
1871    
1872  TinyMCE:  kdebase-workspace
1873  wordpress          - kdebase <unfixed> (old-version)
 moodle  
 knowledgeroot  
 joomla (ITP)  
   
 scintilla:  
 scite  
 qscintilla  
 qscintilla2  
 geany  
   
 libphp-adodb:  
 gallery2  
 phppgadmin  
 egroupware  
 phpwiki  
 ipplan  
 typo3  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
1874    
1875  gzip:  file
1876  linux-kernel (lib/inflate.c)          - php5 <unfixable> (modified-embed)
1877  klibc (based on linux-kernel gzip code)          [lenny] - php5 <not-affected>
 busybox  
1878    
1879  neon:  cdb
1880  cadaver (all, but being worked on: #188381)          - php5 <unfixed> (embed)
 gnome-vfs2 (#395874)  
 litmus (#395875)  
 screem (sarge only)  
 sitecopy (#395876)  
 tla (etch/sid only: #395877)  
1881    
1882  libmodplug:  libmbfl (itp: #570708)
1883  gst-plugins-bad0.10          - php5 <unfixed> (embed)
1884            NOTE: PHP is actually the current upstream, ITP is of that code
1885    
1886  libvncserver:  libonig
1887  vino          - php5 5.3.2-1 (embed)
1888    
1889  putty:  xmlrpc-epi
1890  filezilla          - php5 <unfixed> (embed)
1891    
1892  tinyxml (not packaged in Debian):  swt-gtk
1893  filezilla          - eclipse <unfixed> (embed; bug #538808)
1894    
1895  gv:  txt2html
1896  evince (ps/ tree from gv 3.5.8)          - wml 2.0.11ds2-1 (embed)
 evince-gtk (not packaged in Debian)  
1897    
1898  libXbae:  ca-certificates
1899  libpawlib2-lesstif package (from Cernlib)          - nss <not-affected> (certificates are in source, but not included in any of the binary packages)
1900    
1901  libXaw:  openexr
1902  libpawlib2-lesstif package (from Cernlib)          - freeimage <unfixed> (embed)
1903    
1904  (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  libmng
1905            - freeimage <unfixed> (embed)
1906    
1907  libgd2:  openjpeg
1908  graphviz (lib/gd seems to be 2.0.33)          - freeimage <unfixed> (embed)
1909    
1910  rar:  libjpeg6b
1911  unrar-nonfree          - freeimage <unfixed> (embed)
1912    
1913  unrar-free: (maybe this code is derived from the original rar, too?)  libjpeg (don't know what exact version)
1914  clamav (seems to be disabled in default config)          - dcmtk <unfixed>
1915            - gdcm <unfixed>
1916            - insighttoolkit <unfixed>
1917            - openarena 0.8.5-5+exp1 (bug #495966)
1918            - outguess <unfixed>
1919            - squeak-vm <unfixed> (embed)
1920            - tremulous <unfixed>
1921            - tuxonice-userui <unfixed> (static)
1922            - fpc <unfixed> (static)
1923            - lazarus <unfixed> (static)
1924            NOTE: inherited from fpc, see #472304
1925            - mseide-msegui <unfixed> (static)
1926            NOTE: inherited from fpc, see #472304
1927            - easymp3gain <unfixed> (static)
1928            NOTE: inherited from fpc, see #472304
1929            - winff <unfixed> (static)
1930            NOTE: inherited from fpc, see #472304
1931            - texlive-bin <not-affected> (included in upstream source as dependency of libgd2, but not built or included in any of the binary packages)
1932    
 mplayer (DirectMedia Object loader):  
 xine-lib (src/libw32dll/)  
 vlc (modules/codec/dmo/)  
1933    
1934  libwpd (WordPerfect converter):  lxr
1935  openoffice.org          - lxr-cvs <unfixed> (embed)
1936    
1937  fsplib (http://sourceforge.net/projects/fsp/):  libfile-copy-recursive-perl
1938  gftp (lib/fsplib version 0.3)          - r-base <unfixed> (embed; bug #577427)
1939            - r-base-core-ra <unfixed> (embed; bug #577429)
1940    
1941  librpcsecgss:  delimmatch
1942  krb5          - r-base <unfixed> (embed; bug #577433)
1943            - r-base-core-ra <unfixed> (embed; bug #577434)
1944    
1945  jasper:  libsmf (ITP: #572558)
1946  ghostscript          - denemo <unfixed> (embed)
1947  gs-gpl          NOTE: http://lists.debian.org/debian-mentors/2010/04/msg00269.html
1948    
1949  libidn:  libselinux
1950  monotone          - dpkg 1.15.6 (static)
1951    
1952  liblua:  xinha (ITP: #479708)
1953  monotone          - horde3 <unfixed>
1954            - serendipity <unfixed>
1955            - openacs <unfixed>
1956            - dotlrn <unfixed>
1957    
1958  libbotan:  dvipng
1959  montone          - texlive-bin <not-affected> (code present in source but not included in the binary packages)
1960    
1961  NetXX:  dvipdfmx
1962  monotone          - texlive-bin <unfixed> (embed)
1963            NOTE: this is intentionally part of the package now, and the separate dvipdfmx package has been removed from sid/squeeze
1964    
1965  libgc:  lcdf-typetools
1966  mono          - texlive-bin 2009-1 (embed)
1967    
1968  lzma:  tex4ht
1969  p7zip          - texlive-bin 2009-1 (embed)
1970    
1971  lzo:  freetype
1972  grub2          - texlive-bin 2009-1 (embed)
1973    
1974  pax code:  freetype2
1975  tar          - texlive-bin 2009-1 (embed)
 cpio  
1976    
1977  t1lib:  silgraphite
1978  tetex-bin (links to system t1lib since 2.0.2)          - texlive-bin <unfixed> (embed)
1979  texlive-bin (links to system t1lib)  
1980    unzip
1981            - texlive-bin 2009-1 (embed)
1982    
1983    jbig2dec
1984            - ghostscript 8.71~dfsg2-1 (embed)
1985    
1986    libxml2
1987            - chromium-browser 5.0.375.29~r46008-1
1988    
1989    protobuf
1990            - chromium-browser 5.0.375.70~r48679-2
1991    
1992    libv8
1993            - chromium-browser 5.0.375.38~r46659-1
1994    
1995    nspr
1996            - chromium-browser 5.0.375.29~r46008-3
1997    
1998    yasm
1999            - chromium-browser 5.0.375.29~r46008-2
2000    
2001    libxslt
2002            - chromium-browser 5.0.375.29~r46008-1
2003    
2004    miniupnpc (not packaged in Debian; ITP bug #444392)
2005            - warzone2100 <unfixed> (embed)
2006    
2007    iniparser (not packaged in Debian; RFP bug #582657)
2008            - warzone2100 <unfixed> (modified-embed)
2009    
2010    pyglet
2011            - sympy <unfixed> (embed; bug #459716)
2012    
2013    mpmath
2014            - sympy <unfixed> (embed; bug #541746)
2015    
2016    curl
2017            - cmake <unknown> (embed)
2018            - criticalmass <unfixed> (static; bug #599061)
2019            - wengophone 2.1.0~beta1-svn9983-1 (embed)
2020    
2021    lib3ds
2022            - boson <unfixed> (embed; bug #600900)
2023            - openscenegraph <unfixed> (embed; bug #601181)
2024    
2025    gaim
2026            - wengophone <unfixed> (embed; bug #601425)
2027    
2028    xcftools
2029            - gnome-xcf-thumbnailer <unfixed> (embed)

Legend:
Removed from v.7700  
changed lines
  Added in v.15537

  ViewVC Help
Powered by ViewVC 1.1.5