/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 7830 by nion, Fri Jan 4 18:01:23 2008 UTC revision 15513 by silvio-guest, Sun Oct 24 06:18:22 2010 UTC
# Line 1  Line 1 
1  Embedded code copies  Embedded code copies
2  ====================  ====================
3    
4  This file collects cases, where a source package embeds code from  This file collects source packages that embed code from other projects.
5  other projects which is considered bad for fixing security flaws  This is considered bad for fixing security flaws because the fix needs
6  because the fix needs to be applied in multiple source packages.  to be applied in multiple source packages.
7    
8  Format:  Format:
9  <srcpkg> (<optional comment about srcpkg>)  <srcpkg> (<optional comment about srcpkg>)
10          - <embedding srcpkg> <status> (<sort>; bug #<number>)          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11          NOTE: optional comments about the linkage of the embedding srcpkg          NOTE: optional comments about the linkage of the embedding srcpkg
12    
13  status: version number fixing the embedded copy, <unfixed>, <removed> or <unknown> if the version number can not be determined  status: version number fixing the embedded copy
14            <unfixed> if the issue is not yet fixed
15            <removed> if the package was removed from the archive
16            <itp> if the package is in the process of being packaged
17            <not-affected> if the package does not use the embedded copy
18            <unknown> if the version number can not be determined
19            <unfixable> for unavoidable cases (e.g., forks that add real value)
20  sort: static (linking statically against a lib)  sort: static (linking statically against a lib)
21        embed (embedding a copy of the library into another source package)        embed (embeds a copy of the library into another source package)
22        fork (the package is not just embedding code but it is a fork and thus might share parts of the source code)        modified-embed (embeds a code copy that differs from upstream code)
23          fork (a full-blown fork of another source package)
24  The srcpkg might be some string to identify the code if there is no specific source package.        old-version (an older version of essentially the same code)
25    
26  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)  The srcpkg might be some string to identify the code if there is no
27          NOTE: Fixed packages link to poppler library unless otherwise noted  specific source package.
28          - gpdf <removed>  
29          [sarge] - gpdf <unfixed>  Everything up to the next line is ignored.
30          NOTE: has been replaced by evince in etch  ---BEGIN
31    poppler
32          - pdftohtml <unknown>          - pdftohtml <unknown>
33          [sarge] - pdftohtml <unfixed>          [sarge] - pdftohtml <unfixed>
34          [etch] - pdftohtml <unfixed>          [etch] - pdftohtml <unfixed>
35          NOTE: has been replaced by poppler-utils          NOTE: has been replaced by poppler-utils
36          - kdegraphics <unfixed> (embed; bug #436164)          - kdegraphics 4:4.2.2-1 (embed; bug #436164)
37          NOTE: the kpdf replacement in KDE 4 is using poppler          - texlive-base 3.0-12 (embed)
         - tetex-bin 3.0-12 (embed)  
38          - texlive-bin 2007-1 (embed)          - texlive-bin 2007-1 (embed)
39          NOTE: links to poppler          - koffice 1:2.0.0-1 (embed; bug #436163)
         - koffice <unfixed> (embed; bug #436163)  
40          - libextractor 0.5.12-1 (embed)          - libextractor 0.5.12-1 (embed)
41          NOTE: libextractor is using its own pdf decoder now          NOTE: libextractor is using its own pdf decoder now
         - libextractor 0.5.12-1 (embed)  
         - pdfkit.framework 0.8-4 (embed)  
42          - ipe <unfixed> (embed)          - ipe <unfixed> (embed)
43          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
44          - ruby-gnome2 <unknown> (embed)          - ruby-gnome2 <unknown> (embed)
45          NOTE: copy only present in source but links to poppler          - pdfedit <unfixed> (embed; bug #510794)
46            - swftools <removed> (embed; bug #551293)
47            - xpdf 3.02-9 (fork)
48    
49    pdksh (no longer developed since 1999)
50            - mksh <unfixable> (fork)
51            - posh <unfixable> (fork)
52    
53  ppmd  ppmd
54          - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)          - libcomplearn-mod-ppmd <unfixed> (fork)
55            NOTE: discussion in #458152
56    
57    libevent
58            - transmission 1.71-1 (embed; bug #529372)
59            - chromium-browser 5.0.375.29~r46008-1
60            - dnsproxy <unknown> (embed)
61    
62    lrmi
63            - read-edid 2.0.0-1 (embed; bug #495131)
64            - s3switch <unfixed> (embed)
65            - xresprobe <unfixed> (embed)
66            - zhcon <unfixed> (embed)
67    
68    php-htmlpurifier
69            - mahara 1.2.5-1 (embed)
70            - knowledgeroot 0.9.9.5-5 (embed)
71            - moodle <unfixed> (embed)
72    
73    peercast
74            - gnome-peercast <removed> (embed)
75            [etch] - gnome-peercast <unfixed> (embed)
76    
77  silc-toolkit  silc-toolkit
78          - silc-client 1.1~beta6-1 (embed)          - silc-client 1.1~beta6-1 (embed)
79    
80    icclib
81            - ghostscript <unfixed> (embed)
82            - argyll <unfixed> (embed)
83    
84    libusb
85            - argyll <unfixed> (embed)
86    
87  dietlibc  dietlibc
88          - ccontrol 0.9.1+20071204-1 (static)          - ccontrol 0.9.1+20071204-1 (static)
89            - mksh <unfixable> (static)
90            NOTE: /bin/mksh-static only, and only on some arches (others use eglibc)
91    
92    libmikmod
93            - sdl-mixer1.2 <unfixed> (embed)
94            TODO: report bug
95    
96  libiax  libiax
97          - iaxmodem <unfixed> (embed)          - iaxmodem <unfixable> (embed; bug #548885)
98    
99    spandsp
100            - iaxmodem <unfixable> (embed; bug #548885)
101    
102    python-paramiko
103            - fabric 0.9.0-2 (embed; bug #561398)
104    
105  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
106          - dpkg <unfixed> (embed)          - dpkg 1.15.6 (static)
107          NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion          NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
108          - rsync <unfixed> (embed)          - rsync <unfixed> (embed)
109            - cherokee <unfixed> (embed)
110          NOTE: somehow derived code base          NOTE: somehow derived code base
111          - mono <unfixed> (embed)          - mono <unfixed> (embed)
112          TODO: check mozilla          TODO: check mozilla
# Line 64  zlib (lots of apps embed a copy, but lin Line 114  zlib (lots of apps embed a copy, but lin
114          - pvpgn 1.7.8-2 (embed)          - pvpgn 1.7.8-2 (embed)
115          - mrtg 2.12.2-1 (embed)          - mrtg 2.12.2-1 (embed)
116          - rpm <unknown> (embed)          - rpm <unknown> (embed)
117          NOTE: pinged joeyh since when rpm was fixed          NOTE: pinged anibal since when rpm was fixed
118            - tuxcmd-modules <unfixed> (embed)
119            - zsync <unfixed>
120            - tra <unfixed>
121            - sash <unfixed>
122            - nsis <unfixed>
123            - pyfits 1:2.3.1-1
124            - mseide-msegui <unfixed>
125            NOTE: mseide
126            - mirrordir <unfixed>
127            - poco <unfixed>
128            - klibc <unfixed>
129            - emboss <unfixed>
130            - ghostscript <unfixed>
131            - freeimage <unfixed>
132            - clamav <unfixed> (fork)
133            NOTE: from the changelog: "libclamav6 does indeed duplicate parts of the zlib code, but there is not way around that"
134            - tuxonice-userui <unfixed> (static)
135            - plt-scheme <unfixed>
136            - perl <unfixed>
137            - paraview <unfixed>
138            - velvet 0.7.56~nozlibcopy-1
139            - gcvs <unfixed>
140            - dump <unfixed>
141            - aide <unfixed> (static)
142            - dar <unfixed> (static)
143            - avfs <unfixed>
144            - fpc <unfixed>
145            - winff <unfixed>
146            NOTE: inherited from fpc, see #472304
147            - lazarus <unfixed>
148            NOTE: inherited from fpc, see #472304
149            - erlang <unfixed> (embed)
150            - gamera 3.2.3-1 (embed)
151            - python2.4 <unfixed> (embed; bug #553403)
152            - python2.5 <unfixed> (embed; bug #553403)
153            - texlive-bin <unknown> (embed)
154    
155    dulwich
156            - hg-git 0.1.0-1 (embed; bug #541996)
157    
158    libvigraimpex
159            - hugin <unfixed> (embed; bug #542259)
160            - enblend-enfuse <unfixed> (embed; bug #542258)
161            - gamera 3.2.3-1 (embed)
162    
163  libbz2  libbz2
164          - dpkg <unfixed> (static)          - dpkg 1.15.6 (static)
165            - amd64-libs <unfixed> (static)
166  ekg          NOTE: let's call it "static"
167          - centericq <unfixed> (embed)          - dar <unfixed> (static)
168          - gaim <unfixed> (embed)          - dump <unfixed> (static)
169          - pigdin <unfixed> (embed)(links dynamically against libgadu)          - unalz 0.64-1 (embed)
170          - kopete 4:3.3.2-5 (embed)          NOTE: has code, by the maint, to use the system version but links against the internal copy
171          - kadu <unfixed> (embed)          - clamav <unfixed> (embed)
172          - gadu <unfixed> (embed)          NOTE: libclamav/nsis/bzlib*
173          NOTE: g/kadu not packaged in Debian yet          - pristine-tar <unfixable> (modified-embed)
174            NOTE: compression code only, not uncompression
175            - r-base-core-ra 1.2.8 (static)
176            - r-base-core 2.11.1 (static)
177            NOTE: links dynamically in squeeze, statically in lenny
178            - rpm <unfixed> (static)
179            NOTE: lsb-rpm package is statically linked, normal rpm links dynamically
180    
181    libyahoo2
182            - centerim <unfixed> (embed; bug #559783)
183    
184    libmsn
185            - centerim <unfixed> (embed; bug #559783)
186    
187    libgadu
188            - centerim <unfixed> (embed; bug #559783)
189            - pidgin <not-affected> (links dynamically since initial release; fixed in gaim)
190            - gaim 1:2.0.0+beta3-3 (embed; bug #360280)
191            - kdenetwork 4:3.3.2-5 (embed)
192            NOTE: from kdenetwork: kopete
193            - ekg 1:1.8~rc0-1 (embed)
194            - kadu 0.6.0.2-3 (embed; bug #504430)
195            - gadu <itp> (embed)
196    
197  xmlrpc (which package is the "origin" of this code?)  xmlrpc (which package is the "origin" of this code?)
198          - drupal <unfixed> (embed)          - drupal <unfixed> (embed)
199          - phpgroupware <unfixed> (embed)          - phpgroupware <unfixed> (embed)
200          - egroupware <unfixed> (embed)          - egroupware <unfixed> (embed)
201          - phpwiki (embed)          - phpwiki <unfixed> (embed)
202          - php4 <unfixed> (embed)          - php4 <removed> (embed)
203          TODO: check, php-pear, IIRC this was reorganized some weeks ago?          TODO: check, php-pear, IIRC this was reorganized some weeks ago?
204    
205  shtool (affects build-time only)  shtool (affects build-time only)
206          - mysql-ocaml <unfixed> (embed)          - mysql-ocaml <unfixed> (embed)
207          - php4 <unfixed> (embed)          - php4 <removed> (embed)
208            - php5 <unfixed> (embed)
209    
210  mozilla source code  xulrunner
211          - mozilla-firefox <unfixed> (embed)          - iceape <unfixed> (embed; bug #561749)
212          - mozilla-thunderbird          - iceweasel 2.0.0.19 (embed)
213          - firefox <removed>          - icedove <unfixed> (embed; bug #561750)
214          [etch] - firefox <unfixed> (embed)          - kompozer <unfixed> (embed; bug #532168)
215          - thunderbird <removed>          - galeon 2.0.2-4 (embed)
216          [etch] - thunderbird <unfixed> (embed)          - epiphany-browser 2.14.3-8 (embed)
217          - iceweasel <unfixed> (embed)          - conkeror 0.9~git080629-2 (embed)
218          - iceape <unfixed> (embed)          - kazehakase 0.4.2-1 (embed)
         - icedove <unfixed> (embed)  
         - xulrunner <unfixed> (embed)  
         - nvu <removed> (embed)  
219    
220  xli  xli
221          - xloadimage <unfixed> (embed)          - xloadimage <unfixed> (embed)
222    
223  lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)  lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
224          - openmotif <unfixed> (embed)          - openmotif <unfixed> (embed)
225          - xfree86/xorg <unfixed> (embed)  
226          NOTE: in libxpm  libxpm
227            - lesstif2 <unfixed> (embed; bug #575750)
228    
229  kerberized apps with BSD origin  kerberized apps with BSD origin
230          - krb4 <unfixed> (embed)          - krb4 <removed> (embed)
231          - krb5 <unfixed> (embed)          - krb5 <unfixed> (embed)
232          - heimdal <unfixed> (embed)          - heimdal <unfixed> (embed)
233    
234  grip (which pkg is the origin?)  grip (which pkg is the origin?)
235          - libcdaudio          - libcdaudio <unfixed>
236          - grip          - grip <unfixed>
237          - gnome-vfs          - gnome-vfs <unfixed>
238          TODO: check vfs2 as well          TODO: check vfs2 as well
239    
240  fudforum  fudforum
241          - phpgroupware-fudforum <unfixed> (embed)          [etch] - phpgroupware <unfixed> (embed)
242          - egroupware-fudforum <removed>          NOTE: phpgroupware-fudforum
243          [sarge] - egroupware-fudforum <unfixed> (embed)          [sarge] - egroupware-fudforum <removed> (embed)
244    
245    libbsd
246            - rdate 1:1.2-3 (embed)
247            - atheme-services <unfixed>
248            - libbsd-arc4random-perl <not-affected> (modified-embed)
249            NOTE: code not used, it links dynamically against libbsd instead
250            - isakmpd <unfixed>
251            - bsdgames <unfixed> (embed)
252            - bsd-mailx <unfixed> (embed)
253            - netcat-openbsd <unfixed> (embed; bug #550611)
254            - openssh <unfixed> (embed)
255            - unworkable <unfixed> (embed)
256            - mksh <unfixed> (modified-embed)
257            NOTE: strlcpy(), only used in /bin/mksh-static on eglibc arches
258            NOTE: FIXME, we should only have one entry: - mksh <not-affected> (modified-embed)
259            NOTE: strlcpy() on dietlibc arches; {g,s}etmode(); both unused
260    
261  cvs  cvs
262          - gcvs <unfixed> (embed)          - gcvs <unfixed> (embed)
263          NOTE: see cvsunix/src in tarball          NOTE: see cvsunix/src in tarball
264    
265  pcre  pcre3
266          - python* <unfixed> (embed)          - php4 <removed> (embed)
         - php4 <unknown> (embed)  
267          - analog 2:5.23-0woody1 (embed)          - analog 2:5.23-0woody1 (embed)
268          - libgoffice-1 <unfixed> (embed)          - goffice <unfixed> (embed)
269            NOTE: libgoffice-*
270          - vfu 4.06-4.1 (embed; bug #450754)          - vfu 4.06-4.1 (embed; bug #450754)
271          - tf5 5.0beta7-1 (embed)          - tf5 5.0beta7-1 (embed)
272          - monotone <unfixed> (embed)          - monotone 0.43-1 (embed)
273          NOTE: this only affects versions >= 0.37          NOTE: this only affects versions >= 0.37
274          - glib <unfixed> (embed)          - glib2.0 2.15.2-1 (embed)
         NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic  
275          - apache2 2.0.53-4 (embed)          - apache2 2.0.53-4 (embed)
276          - exim4 4.10-0.srh20.12 (embed)          - exim4 4.10-0.srh20.12 (embed)
277          - yacas <unfixed> (embed)          - yacas <unfixed> (embed)
278          NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway          NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
279          - gtamsanalyzer.app 0.42-5 (embed)          - gtamsanalyzer.app 0.42-5 (embed)
280            - tin 980117-1 (embed)
281            - kazehakase 0.5.2-1
282            - webkit 1.0.1-1 (embed)
283            - qt4-x11 <unfixed> (embed)
284            NOTE: embedded via webkit copy
285            - erlang <unfixed> (embed)
286            - ssed <unfixed> (embed)
287            - ircd-hybrid <unfixed> (static)
288            - emboss <unfixd>
289            - cherokee <unfixed> (embed)
290            - oftc-hybrid 1.6.9.dfsg-1 (embed)
291            - ratbox-services <unfixed> (embed)
292            - squeak-vm <unfixed> (embed)
293            - tinymux <unfixed> (embed)
294    
295  tiff  tiff
296          - wxpythongtk <unfixed> (embed)          - wxwindows2.4 2.2.1 (embed)
297          TODO: check, which debian pkg this is in          - gamera 3.2.3-1 (embed)
298            - freeimage <unfixed> (embed)
299            - libtk-img <unfixed> (embed)
300            NOTE: there are two copies, one under tiff/ other under libtiff/
301            - gdal <unfixed>
302    
303  uudeview  uudeview
304          - libconvert-uulib-perl <unfixed> (embed)          - libconvert-uulib-perl <unfixed> (embed)
305            - pan <unfixed> (embed)
306    
307  sqlite (not affected by security vulnerabilities so far)  sqlite (not affected by security vulnerabilities so far)
308          - amarok <unfixed> (embed)          - amarok <unfixed> (embed)
309          - monotone <unfixed> (embed)          - monotone 0.43-1 (embed)
310          - iceweasel <unfixed> (embed)          - iceweasel <unfixed> (embed)
311            - heimdal <unfixed> (embed; bug #559616)
312    
313  util-linux/mount  util-linux/mount
314          - loop-aes-utils <unfixed> (embed)          - loop-aes-utils <unfixed> (embed)
315          NOTE: contains code from util-linux' mount in the mount-aes-udeb          NOTE: contains code from util-linux' mount in the mount-aes-udeb
316    
 webmin  
         - usermin <unknown> (embed)  
         [sarge] - usermin <unfixed> (embed)  
   
317  sylpheed  sylpheed
318          - sylpheed-claws <unfixed> (fork)          - sylpheed-claws <unfixed> (fork)
319    
# Line 176  phpsysinfo Line 322  phpsysinfo
322          - phpgroupware <unfixed> (embed)          - phpgroupware <unfixed> (embed)
323    
324  phpldapadmin  phpldapadmin
325          - [sarge] egroupware <unfixed> (embed)          [sarge] - egroupware <unfixed> (embed)
326          NOTE: removed from egroupware after sarge          NOTE: removed from egroupware after sarge
327    
328  chmlib  chmlib
329          - kchmviewer <unknown> (embed)          - kchmviewer <unknown> (embed)
330    
331  libavcodec/libavformat (source: ffmpeg)  ffmpeg (libavcodec/libavformat)
332          - mplayer <unfixed> (embed; bug #395252)          - mplayer 1.0~rc2-14 (embed; bug #395252)
333          - xvidcap <unfixed> (embed)          - kino 1.0.0-1
334          - kino <unfixed> (static)          - vlc <not-affected> (Links dynamically since initial release)
335          - vlc <unfixed> (static)          - smilutils 0.3.0-10
336          - smilutils <unfixed> (static)          NOTE: smilutils likely fixed earlier, marking Etch's version as fixed
337          - motion <unfixed> (static)          - motion 3.1.19-1
338          - gst-ffmpeg <unfixed> (embed)          - gstreamer0.10-ffmpeg 0.10.3-2
339          - gstreamer0.10-ffmpeg <unfixed> (embed)          - xmovie <removed> (static)
340          - xmovie <unfixed>          TODO: gimp-gap (potentially using ffmpeg code as well)
341            - avifile 1:0.7.48~20090503.ds-1 (embed; bug #538750)
342            - audacity 1.3.7-2 (embed; bug #512278)
343            - chromium-browser <unfixed> (fork)
344    
345    faad2
346            - mplayer 1.0~rc2-20 (embed)
347            - avifile <unfixed> (embed; bug #538750)
348            - ffmpeg-debian <removed> (embed)
349    
350  mad MPEG decoding lib  libmad (MPEG decoding lib)
         - mad <unfixed> (embed)  
351          - xine-lib <unfixed> (embed)          - xine-lib <unfixed> (embed)
352            - avifile 1:0.7.48~20090503.ds-1 (embed) [./plugins/libmad/*]
353            TODO: check ocaml-mad, madplay, pymad, xmms-mad, xmms2
354    
 libdts:  
355  libdts  libdts
356  xine-lib          - xine-lib <unfixed> (embed)
357    
 flac:  
358  flac  flac
359  xine-lib          - xine-lib <unfixed> (embed)
360    
361  liba52:  liba52
362  a52dec          - a52dec <unfixed> (embed)
363  xine-lib          - xine-lib <unfixed> (embed)
364    
365  libmpeg2:  mpeg2dec (libmpeg2)
366  mpeg2dec          - xine-lib <unfixed> (embed)
 xine-lib  
367    
368  curl:  libmpeg3
369  wget (code for NTLM authentication)          - squeak-vm <unfixed> (embed)
370    
371  TODO evaluate:  libntlm
372  gimp-gap (potentially using ffmpeg code as well)          - wget <unfixed> (fork; bug #550436)
373            - curl <unfixed> (fork; bug #550437)
374            - cntlm <unfixed> (fork; bug #550438)
375    
376  uw-imap:  uw-imap
377  pine          - pine <unfixed> (embed)
378  alpine          - alpine <unfixed> (embed)
379    
380  imagemagick:  imagemagick
381  graphicsmagick          - graphicsmagick <unfixed> (fork)
382    
383  halibut:  python-urlgrabber
384  nsis          - mercurial <unfixed> (embed; bug #531062)
385            - w3af <unfixed> (embed; bug #555372)
386            [experimental] - harvestman <unfixed> (embed; bug #555373)
387    
388  libghttp:  beautifulsoup
389  hotway          - python-mechanize <unfixed> (embed; bug #555349)
390            - zope2.11 <removed> (embed; bug #555350)
391            - twill <unknown> (embed)
392    
393  libsndfile:  halibut
394  ardour          - nsis <unfixed> (fork)
395    
396  glibmm2.4:  libghttp
397  ardour          - hotway <unfixed> (embed)
398    
399  libgnomecanvasmm2.6:  libsndfile
400  ardour          - ardour 1:2.7.1-1 (embed)
401    
402  libsigc++-2.0:  glibmm2.4
403  ardour          - ardour 1:2.7.1-1 (embed)
404    
405  soundtouch:  libgnomecanvasmm2.6
406  ardour          - ardour 1:2.7.1-1 (embed)
407    
408  libmms:  libsigc++-2.0
409  xine-lib          - ardour 1:2.7.1-1 (embed)
 mimms  
410    
411  FCKeditor: (packaged as fckeditor)  soundtouch
412  knowledgeroot          - ardour 1:2.7.1-1 (embed)
 moin (452599)  
 karrigell (452598)  
 gforge-plugins-extra (fixed since 4.6.99+svn6225-1)  
413    
414    libmms
415            - xine-lib <unfixed> (embed)
416            - mimms <unfixed> (embed)
417    
418    fckeditor
419            - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
420            - moin 1.8.2-2 (embed; bug #452599)
421            - karrigell <removed> (embed; bug #452598)
422            - gforge 4.6.99+svn6225-1 (embed)
423            - request-tracker3.8 <unfixed> (embed)
424            - otrs2 <unfixed> (embed)
425    
426    ipatlas (not packaged in Debian)
427            - moodle <unfixed> (embed; bug #507185)
428    
429    libphp-phpmailer
430            - moodle <unfixed> (embed; bug #507185)
431            - mahara <unfixed> (embed)
432            - symfony <unfixed> (embed; bug #566778)
433            [etch] - phpgroupware <unfixed> (embed)
434            NOTE: phpgroupware-felamimail is only in etch
435            - egroupware <unfixed> (embed; bug #504283)
436            - glpi <unfixed>
437    
438    htmlArea (not packaged in Debian)
439            - moodle <unfixed> (embed)
440    
441    giflib
442            - wine <unfixed> (embed; bug #466181)
443    
444    bennu (not packaged in Debian, http://bennu.sourceforge.net)
445            - moodle <unfixed> (embed)
446    
447    smarty
448            - moodle 1.8.2-2 (embed; bug #471158)
449            - gallery2 2.2.5-2 (embed; bug #471160)
450            - mahara 0.9.2-2 (embed; bug #471201)
451            - gosa 2.4beta1-1 (embed; bug #471200)
452    
 Moodle contains lots of things:  
 AdoDB  
 AdoDB-XML Schema  
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
453  TinyMCE  TinyMCE
454  bennu          - wordpress 2.5.1-3 (embed; bug #478257)
455            - moodle <unfixed> (embed; bug #507185)
456            - knowledgeroot <unfixed> (embed)
457            - joomla <itp> (bug #326398)
458            - mahara 1.2.6-1 (embed; #597752)
459    
460    scintilla (upstream provides static lib, rejected shared lib http://sf.net/support/tracker.php?aid=2488121)
461            - scite <unfixed> (embed)
462            - qscintilla <unfixed> (embed)
463            - qscintilla2 <unfixed> (embed)
464            - geany <unfixed> (fork)
465            - anjuta <unfixed> (embed)
466    
467    libphp-adodb
468            - moodle <unfixed> (embed; bug #507185)
469            NOTE: also AdoDB-XML Schema
470            - gallery2 <unfixed> (embed)
471            - phppgadmin <unfixed> (embed)
472            - egroupware <unfixed> (embed)
473            - phpwiki <unfixed> (embed)
474            - torrentflux 2.0beta1-2 (embed)
475            - ipplan <unfixed> (embed)
476            - typo3-src <unfixed> (embed)
477            - cacti <unknown> (embed)
478            [sarge] - cacti <unfixed> (embed)
479            NOTE: dependency exists, but internal version is used
480            - gforge 4.7~rc2-6 (embed)
481            - mahara <unfixed> (embed)
482    
483    gzip
484            - linux-2.6 <unfixed> (embed) [lib/inflate.c]
485            - klibc <unfixed> (embed)
486            NOTE: based on linux-kernel gzip code
487            - busybox <unfixed> (embed)
488            - pristine-tar <unfixed> (modified-embed)
489            NOTE: compression code only, not uncompression
490            - ncompress <unfixed> (old-version)
491    
492    neon
493            - cadaver 0.22.3+debian-1 (embed; bug #188381)
494            - gnome-vfs2 <unfixed> (embed; bug #395874)
495            [etch] - litmus <unfixed> (embed; #395875)
496            - litmus <removed> (embed; #395875)
497            [sarge] - screem <unfixed> (embed)
498            - sitecopy 1:0.16.0-1 (embed; bug #395876)
499            [etch] - tla <unfixed> (embed; bug #395877)
500            [sarge] - tla <unfixed> (embed; bug #395877)
501    
502    libmodplug
503            - gst-plugins-bad0.10 0.10.10.2-1 (embed)
504    
505    libvncserver
506            - vino <unfixed> (embed)
507    
508    putty
509            - filezilla <unfixed> (embed)
510    
511    tinyxml (not packaged in Debian; itp bug #531968)
512            - filezilla <unfixed>
513            - crystalspace <unfixed> (embed)
514            - libwfut <unfixed> (embed)
515            - rarian <unfixed> (embed)
516            - bulletml <unfixed> (embed)
517            - pokerth <unfixed> (embed)
518            - qutecom <unfixed> (embed)
519            - sofa-framework <unfixed> (embed)
520            - yate <unfixed> (embed)
521            - antigrav <unfixed> (embed)
522            - balder2d <unfixed> (embed)
523            - cal3d <unfixed> (embed)
524            - criticalmass <unfixed> (embed)
525            - ember <unfixed> (embed)
526            - epiphany <unfixed> (embed)
527            - gambit <unfixed> (embed)
528            - noiz2sa <unfixed> (embed)
529            - ogre <unfixed> (embed)
530            - opencity <unfixed> (embed)
531            - openmovieeditor <unfixed> (embed)
532            - pouetchess <unfixed> (embed)
533            - tecnoballz <unfixed> (embed)
534            - trigger-rally <unfixed> (embed)
535            - xmoto <unfixed> (embed)
536            - mapnik <unknown> (embed)
537            NOTE: uses a different XML parser by default
538            - rrootage 0.23a-6 <embed>
539            NOTE: links to libbulltetml
540            - boson <unknown> (embed)
541            NOTE: the embedded code is unused
542    
543    gv
544            - evince <unfixed> (embed)
545            NOTE: ps/ tree from gv 3.5.8
546            NOTE: evince-gtk is affected (a component of evince source package)
547    
548    libXbae
549            - paw <unfixed> (embed)
550    
551    libgtkhtml
552            - claws-mail-extra-plugins <unfixed> (fork)
553    
554    libXaw
555            - paw <unfixed> (embed)
556            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
557    
558    libgd2
559            - graphviz <unfixed> (embed)
560            NOTE: lib/gd seems to be 2.0.33
561            - wml 2.0.11ds2-1 (embed)
562            - libwmf <unfixed> (embed)
563            NOTE: derived from gd 1.6.3
564            - texlive-bin 2009-1 (embed)
565    
566    rar
567            - unrar-nonfree <unfixed> (embed)
568    
569    unrar-free (maybe this code is derived from the original rar, too?)
570            - clamav <unfixed> (embed)
571            NOTE: seems to be disabled in default config
572    
573    mplayer (DirectMedia Object loader)
574            - xine-lib <unfixed> (embed)
575            NOTE: src/libw32dll/
576            - vlc <unfixed> (embed)
577            NOTE: modules/codec/dmo/
578            - mplayer 1.0~rc2-20 (embed)
579    
580    libwpd (WordPerfect converter)
581            - openoffice.org <unfixed> (embed)
582    
583    fsplib (http://sourceforge.net/projects/fsp/)
584            - gftp <unfixed> (embed)
585            NOTE: lib/fsplib version 0.3
586    
587    sprng
588            - tree-puzzle <unfixed> (embed)
589    
590    librpcsecgss
591            - krb5 <unfixed> (embed)
592    
593    jasper
594            - ghostscript 8.64~dfsg-2 (embed)
595    
596    libiris
597            - psi <unfixed> (embed)
598            - kdenetwork <unfixed> (embed)
599            NOTE: kopete embeds libiris but links dynamically to libidn
600            - kdegames <unfixed> (embed)
601            NOTE: ksirk/kde4
602    
603    libidn
604            - monotone 0.43-1 (embed)
605            - psi <unfixed> (embed)
606            NOTE: psi embeds libiris which embeds libidn
607            - kdegames <unfixed> (embed)
608            NOTE: kdegames/kde4 embeds libiris which embeds libidn
609    
610    lua5.1
611            - monotone 0.43-1 (embed)
612            - nmap 5.00-1 (embed; bug #527997)
613            [lenny] - nmap <unfixed> (embed; bug #527997)
614            - ocropus <unfixed> (embed)
615            - enigma <unfixed> (embed)
616            NOTE: requires lua built with C++
617            - freeciv <unfixed> (embed)
618            - spring <unfixed> (embed)
619    
620    libbotan
621            - monotone 0.43-1 (embed)
622    
623    NetXX
624            - monotone 0.43-1 (embed)
625    
626    libgc
627            - mono <unfixed> (embed)
628    
629    lzma
630            - p7zip <unfixed> (embed)
631            - xz-utils <unfixed> (fork)
632            - r-base <unfixed> (embed)
633            NOTE: lzma support not yet in lenny or in r-base-core-ra 1.2.8
634    
635    lzo
636            - grub2 <unfixed> (embed)
637    
638    yassl
639            - mysql-dfsg-5.0 <unfixed> (embed)
640            - mysql-5.1 <unfixed> (embed)
641    
642    pax code
643            - tar <unfixed> (embed)
644            - cpio <unfixed> (embed)
645    
646    t1lib
647            - tetex-bin 2.0.2-1 (embed)
648            - texlive-bin <unknown> (embed)
649            - grace <unknown> (embed)
650    
651    guichan
652            - boswars <unfixed> (embed)
653            NOTE: maintainer notified us, working on it
654    
655    tolua
656            - boswars <unfixed> (embed)
657            NOTE: maintainer notified us, working on it
658            NOTE: actually tolua++
659            - ocropus <unfixed> (embed)
660            NOTE: actually tolua++
661            - freeciv <unfixed> (embed)
662            NOTE: actually tolua++
663            - enigma <unfixed> (embed)
664    
665    asio-dev
666            - luxrender <removed> (embed)
667    
668    xine-lib
669            - vlc <unfixed> (embed)
670            NOTE: only parts included in modules/access/rtsp
671    
672    netpbm
673            - tcl8.3 <unfixed> (embed)
674            - tcl8.4 <unfixed> (embed)
675            - tcl8.5 <unfixed> (embed)
676            NOTE: generic/tkImgGIF.c
677    
678    tk8.5
679            - tk8.0 <removed> (old-version)
680            - tk8.3 <unfixed> (old-version)
681            - tk8.4 <unfixed> (old-version)
682            - perl-tk <unfixable> (fork)
683    
684    samba
685            - mc 2:4.6.2~git20080311-1 (embed)
686            NOTE: maintainer is aware of this, currently searching a solution
687    
688    plib1.8.4c2
689            - boson <unfixed> (fork)
690            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
691    
692    fribidi
693            - quesoglc 0.7.2-2 (embed)
694    
695    glew
696            - quesoglc <unfixed> (embed; bug #489341)
697            NOTE: waiting on GLEW_MX version of glew (see bug #474488)
698            - trigger 0.5.2.1-2 (embed)
699            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
700            - trigger-rally 0.5.2.1-2 (embed)
701            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
702            - chromium-browser 5.0.375.70~r48679-2
703    
704    minorGems (pabs contacted upstream about shared lib, he considers minorGems an 'ever-evolving collection of reusable code fragments' for his own use)
705            - transcend <unfixed> (embed)
706            - cultivation <unfixed> (embed)
707            - passage <unfixed> (embed)
708            - gravitation <unfixed> (embed)
709    
710    tar
711            - libarchive <unfixed> (embed)
712            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
713    
714    cpio
715            - libarchive <unfixed> (embed)
716            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
717    
718    kde4libs
719            - kdelibs <unfixable> (old-version)
720    
721    webkit
722            - qt4-x11 <unfixed> (embed; bug #479851)
723            [etch] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
724            - kde4libs <unfixable> (fork)
725            NOTE: kde4lib's khtml and webkit were forked from khtml (this tracking, which seems
726            NOTE: reversed genesis-wise, is used because of so much other stuff in kde4libs)
727            - chromium-browser <unfixed> (fork)
728    
729    ftgl
730            - blender 2.46+dfsg-1 (embed)
731    
732    wv
733            - abiword <unfixed>
734    
735    qemu
736            - kvm <removed> (embed; bug #543159)
737            - qemu-kvm <unfixed> (embed; bug #560853)
738            NOTE: kvm superceded by qemu-kvm, which is just user interface (no modules)
739            - xen-3 3.4.2-2 (embed; bug #560856)
740            - xen-unstable <unfixed> (embed; bug #560856)
741    
742    vgabios
743            - kvm <removed> (embed; bug #489442)
744            - qemu-kvm <unfixed> (embed)
745    
746    bochs
747            - kvm <removed> (embed; bug #489442)
748            - qemu-kvm <unfixed> (embed)
749    
750    speex
751            - vorbis-tools <unfixed> (embed)
752            NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
753            - gst-plugins-good0.10 <unfixed> (embed)
754            - xine-lib <unfixed> (embed)
755            - libfishsound <unfixed> (embed)
756            - libannodex <removed> (embed)
757            - libopal-2.2 <unknown> (embed)
758            - mumble <unknown> (embed)
759            - vlc <unfixed> (embed)
760            - xmms-speex <unfixed> (embed)
761            - libsdl-sound1.2 <unfixed> (embed)
762            - sweep <unfixed> (embed)
763    
764    libreadline
765            - magic <itp> (old-version)
766    
767    opcode
768            - ode <unfixed> (embed)
769            NOTE: opcode is not a package in debian, it is just embedded
770            NOTE: http://www.codercorner.com/Opcode.htm
771    
772    gimpact
773            - ode <unfixed> (embed)
774            NOTE: gimpact is not a package in debian, it is just embedded
775            NOTE: http://gimpact.sf.net
776    
777    mochikit
778            - mahara <unfixed> (embed)
779            NOTE: they require extra patches, still unmerged upstream
780            - ntop <unfixed> (embed)
781            - coherence 0.6.2-1 (embed)
782            - paste <unfixed> (embed)
783            - turbogears <unfixed> (embed)
784            - plone3 <removed> (embed)
785            - xulrunner <unfixed> (embed)
786            - libjifty-plugin-chart-perl <unfixed> (embed)
787            - sabnzbdplus <unfixed> (embed)
788            - tgmochikit <unfixed> (embed)
789    
790    prototypejs
791            - netbeans-ide 6.0.1+dfsg-2 (embed)
792            - auth2db 0.2.5-2+dfsg-1 (embed; bug #555218)
793            - webcit <unfixed> (embed; bug #555219)
794            - asterisk 1:1.6.2.0~rc3-1 (embed)
795            - libjson-ruby 1.1.4-1 (embed; bug #555224)
796            - lucene2 2.9.1+ds1-2 (embed; bug #555226)
797            - horde3 <unfixed> (embed)
798            - knowledgeroot 0.9.8.5-4 (embed; bug #555230)
799            - mediatomb 0.12.0~svn2018-5 (embed; bug #555233)
800            - mt-daapd 0.9~r1696.dfsg-6lenny2 (embed)
801            - ebug-http <unfixed> (embed; bug #555236)
802            - libaws 2.7-1 (embed; bug #555222)
803            - phpgedview <removed> (embed)
804            - poker-network 1.7.6-1 (embed; bug #555238)
805            - rails 2.1.0-6 (embed)
806            - wordpress 2.5.0-2 (embed; bug #555243)
807            - zope <not-affected> (the prototypejs embed is not in any of the obvious zope packages, e.g. zope2.9, zope2.10, zope2.11, and zope3)
808            TODO: search through all of the other zope packages
809            - ampache 3.4.1-2 (embed)
810            - exaile 0.2.14+debian-2.1 (embed; bug #555245)
811            - hobix 0.5~svn20070319-4 (embed; bug #555247)
812            - zabbix 1.6.6-4 (embed; bug #555250)
813            - chora2 2.1.1+debian0-1 (embed; bug #555253)
814            - gollem 1.1.1+debian0-1 (embed; bug # 555254)
815            - jscropperui 1.2.1-1 (embed; bug #555257)
816            - scriptaculous <not-affected> (uses system prototype.js since initial upload; bug #555260)
817            - ingo1 1.2.3+debian0-1 (embed; bug #555261)
818            - kronolith2 2.3.3+debian0-1 (embed; bug #555262)
819            - activeldap 1.2.1-1 (embed)
820            - libv8 <not-affected> (contains a google-specific implementation of prototype.js)
821            - mantis 1.1.2+dfsg-1 (embed; bug #555265)
822            - otrs2 2.3.4-6 (embed; bug #555267)
823            - webcalendar 1.2~b1-2 (embed; bug #555269)
824            - redmine 0.9.0~svn2907-1 (embed; bug #555270)
825            - jifty 0.90519-1 (embed; bug #555271)
826            - jquery 1.4-1 (embed; bug #555272)
827            - passenger 2.2.5debian1-1 (embed; bug #555273)
828            - plone3 <removed> (embed; bug #555275)
829            - wesnoth <not-affected> (prototype.js not included in any of the binary packages; bug #555277)
830            - libhtml-prototype-perl 1.48-3 (embed; bug #538920)
831            - xulrunner <unfixed> (embed)
832            NOTE: included in iceweasel/xulrunner unit tests directory, so may not be security-relevant
833            - jclicmoodle <unfixed> (embed)
834            - git-cola <unfixed> (embed)
835    
836    gdb
837            - insight <unfixed> (embed)
838    
839    e2fsprogs
840            - ldiskfsprogs <unfixable> (fork)
841    
842    quazip (not packaged in Debian)
843            - qcake <unfixed> (embed)
844            NOTE: starting with upstream version 0.6.4
845    
846    exo
847            - pcmanfm <unfixed> (embed; bug #499677)
848            NOTE: slightly modified source code
849    
850    java
851            - openjdk-6 <unfixed>
852            - sun-java5 <unfixed>
853            - sun-java6 <unfixed>
854    
855    libphp-snoopy
856            - ampache 3.4.1-2 (embed; bug #504169)
857            - gforge 4.6.99+svn6094-2 (embed)
858            - mahara 1.0.5-2 (embed; bug #504170)
859            - pixelpost 1.7.1-5 (embed; bug #504171)
860            - mediamate 0.9.3.6-5 (embed; bug #504172)
861            - opendb <removed> (embed; bug #504173)
862            [etch] - opendb <unfixed> (embed; bug #504173)
863            - wordpress 2.5.1-9 (embed; bug #443948)
864            - moodle <unfixed> (embed; bug #507185)
865            [etch] - phpgroupware <unfixed> (embed)
866            NOTE: phpgroupware-felamimail
867            - magpierss 0.72-3 (embed; bug #431089)
868    
869    jquery
870            - zekr <unfixed> (embed)
871            - wordpress <unknown> (embed)
872            - yocto-reader <unfixed> (embed)
873            - textpattern <unfixed> (embed)
874            - genshi 0.5.1-1 (embed)
875            NOTE: compressed file under examples/ dir
876            - prewikka <unfixed> (embed)
877            - libramaze-ruby <unfixed> (embed)
878            - drupal6 <unfixed> (embed)
879            - b2evolution <unfixed> (embed)
880            - wesnoth <unfixed> (embed)
881    
882    tablesorter (jquery plugin, not packaged yet)
883            - wesnoth <unfixed> (embed)
884    
885    kses
886            - wordpress <unfixed> (embed; bug #504242)
887            NOTE: their copy has all methods renamed to wp_<foo>
888            NOTE: kses isn't in Debian, RFP: #504240
889            - moodle <unfixed> (embed; bug #507185)
890            - egroupware <unfixed> (embed)
891    
892    magpierss
893            - wordpress <unfixed> (embed; bug #504242)
894            - moodle <unfixed>
895    
896    php-gettext
897            - wordpress 2.8.4-1 (embed; bug #504242)
898            - docbookwiki <unfixed> (embed)
899            - knowledgeroot 0.9.9.5-1
900            NOTE: non-free
901    
902    libphp-ixr (name may change, it is the Incutio XML-RPC)
903            - wordpress <unfixed> (embed; bug #504242)
904            NOTE: libphp-ixr isn't in Debian, RFP: #504236
905            - dokuwiki <unfixed> (embed)
906            - textpattern <unfixed> (embed)
907    
908    libphp-cas
909            - glpi <unfixed> (embed)
910            - moodle <unfixed> (embed; bug #505984)
911    
912    scriptaculous (prototype.js is among the embeds in the following)
913            - glpi <unfixed> (embed)
914            - libaws <unfixed> (embed; bug #555222)
915            - op-panel <unfixed> (embed)
916            - symfony <unfixed> (embed)
917            NOTE: maintainer says there are extra incompatible changes required
918            - pixelpost 1.7.1-6 (embed)
919            - webhelpers <unfixed> (embed)
920            - qwik <removed> (embed; bug #555241)
921            - smokeping <unfixed> (embed)
922            - turba2 <unfixed> (embed)
923            - typo3-src 4.2.3-1 (embed)
924            - request-tracker3.6 <unfixed> (embed)
925            - request-tracker3.8 <unfixed> (embed)
926            - rt-extension-emailcompletion <not-affected> (prototype.js not included in the binary package)
927            - wordpress 2.5.0-2 (embed)
928            - libhtml-prototype-perl 1.48-3 (embed)
929    
930    libmarkdown-php
931            - moodle <unfixed> (embed; bug #507185)
932            - pixelpost 1.7.1-6 (embed)
933    
934    php-openid
935            - wordpress-openid 3.3.2-1 (embed)
936    
937    geshi
938            - dokuwiki 0.0.20080505-3.1 (embed)
939            - pgfouine 1.0-1.1 (embed)
940            - websvn 2.1.0-1 (embed)
941    
942    webcalendar
943            - gforge 4.7~rc2-6 (embed; bug #504758)
944    
945    libical
946            - kdepim <unknown> (fork)
947            NOTE: fixed at some point during 4.0
948            - kdepimlibs 4.2.0-1 (fork)
949            - claws-mail-extra-plugins <unfixed> (fork)
950    
951    harfbuzz
952            - qt4-x11 <unfixed> (embed)
953            - pango1.0 <unfixed> (embed)
954            - fontmatrix <unfixed> (embed)
955    
956    libzip
957            - php5 <unfixable> (modified-embed)
958            - odt2txt <unfixed> (embed; bug #523808)
959    
960    json.php (not packaged; should be replaced with php's built-in functions)
961            - moodle <unfixed>
962            - yui <unfixed>
963            - gallery2 <unfixed>
964            - dokuwiki <unfixed>
965            - typo3-src <unfixed>
966    
967    php-fpdf
968            - tcpdf <itp> (fork)
969            - moodle <unfixed>
970            - phpwiki <unfixed>
971            - egroupware <unfixed>
972            - ldap-account-manager <unfixed> (fork)
973    
974    tcpdf (itp: #495985)
975            - moodle <unfixed>
976            - phpmyadmin <unfixed>
977    
 TinyMCE:  
 wordpress  
 moodle  
 knowledgeroot  
 joomla (ITP)  
   
 scintilla:  
 scite  
 qscintilla  
 qscintilla2  
 geany  
   
 libphp-adodb:  
 gallery2  
 phppgadmin  
 egroupware  
 phpwiki  
 ipplan  
978  typo3  typo3
979  moodle          - moodle <unfixed>
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
980    
981  gzip:  spreadsheet_writeexcel (PHP port of libspreadsheet-writeexcel-perl; itp: #487557)
982  linux-kernel (lib/inflate.c)          - moodle <unfixed>
983  klibc (based on linux-kernel gzip code)          - gosa <unfixed>
984  busybox  
985    php-ole (itp: #487558)
986            - moodle <unfixed>
987    
988    pieforms (http://www.catalyst.net.nz)
989            - mahara <unfixed>
990    
991    savant2 (http://phpsavant.com)
992            - egroupware <unfixed>
993    
994    rssparser (http://nwow.org)
995            - egroupware <unfixed>
996            - phpgroupware <unfixed>
997    
998    lcms
999            - openjdk-6 <unfixed> (fork)
1000            - gimp 2.4.0~rc2-2
1001    
1002    libphp-phplayersmenu
1003            - diogenes <unfixed>
1004            - phpldapadmin <unfixed>
1005    
1006    libphp-pclzip
1007            - docvert <unfixed>
1008            - moodle <unfixed>
1009            - egroupware <unfixed>
1010    
1011    libphp-simplepie
1012            - dokuwiki <unfixed>
1013            - wordpress <unfixed>
1014    
1015    libphp-jpgraph
1016            - egroupware <unfixed>
1017    
1018    php-simpletest
1019            - moodle <unfixed>
1020    
1021    libpng
1022            - iceweasel <not-affected> (uses xulrunner)
1023            - icedove 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1, 2.0.0.19-1 (embed)
1024            - iceape 1.0.13~pre080614i-0etch1 (embed)
1025            - xulrunner 1.9.0.13-1 (embed)
1026            [lenny] - xulrunner 1.9.0.11-0lenny1
1027            [etch] - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
1028            - gamera 3.2.3-1 (embed)
1029            - freeimage <unfixed> (embed)
1030            - tuxonice-userui <unfixed> (static)
1031    
1032    irssi
1033            - silc-client <unfixed> (embed)
1034            NOTE: Seems to be a pre-0.8.12 version that is used in irssi-plugin-silc
1035    
1036    extc
1037            - mtasc <unfixed> (embed)
1038            - haxe <unfixed> (embed)
1039    
1040    swflib
1041            - mtasc <unfixed> (embed)
1042            - haxe <unfixed> (embed)
1043    
1044    libitext-java
1045            - bouncycastle 2.1.4-1 (embed)
1046    
1047    python-ply
1048            - pyke <unfixed> (embed; bug #555363)
1049            - pywbem 0.7.0-4 (embed; bug #555364)
1050            - sepolgen <unfixed> (embed; bug #555365)
1051            - zope-textindexng3 <unknown> (embed)
1052            - iceweasel <not-affected> (uses xulrunner)
1053            - xulrunner <unknown> (embed)
1054            - wireshark <not-affected> (python-ply modules are not installed into binary packages; see #554613)
1055    
1056    libdumbnet (libdnet upstream)
1057            - nmap <unfixed> (fork)
1058    
1059    gcc-4.4
1060            - gcc-mingw32 <unfixed> (embed)
1061    
1062    camlimages
1063            - advi <unfixed> (static; bug #550441)
1064    
1065    memcached
1066            - memcachedb <unfixed> (embed)
1067    
1068    yajl
1069            - argyll <unfixed> (embed; bug #544223)
1070            NOTE: reference, confirmed by build logs: http://lists.debian.org/debian-mentors/2009/08/msg00062.html
1071    
1072    nusoap
1073            - gforge 4.8.2-1 (embed)
1074            - ampache <unfixed> (embed)
1075            - poker-network <unfixed> (embed)
1076            - moodle <unfixed> (embed)
1077            NOTE: code is not used when running under php5 and soap is enabled
1078            - phpwiki <unfixed> (embed)
1079            - gallery2 <unfixed> (embed)
1080            - typo3-src <unfixed> (embed)
1081            - phpgacl 3.3.7-7 (embed)
1082            - mantis 1.1.8+dfsg-1 (embed)
1083    
1084    libept
1085            - adept <unfixed> (embed; bug #540649)
1086    
1087    libvorbis
1088            - iceweasel <not-affected> (uses xulrunner)
1089            - xulrunner <unfixed> (embed; bug #540959)
1090            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1091            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1092            - iceape <unfixed> (embed)
1093            [etch] - iceape <not-affected> (introduced in 2.0)
1094            [lenny] - iceape <not-affected> (introduced in 2.0)
1095    
1096  neon:  cairo
1097  cadaver (all, but being worked on: #188381)          - iceweasel <not-affected> (uses xulrunner)
1098  gnome-vfs2 (#395874)          - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
1099  litmus (#395875)  
1100  screem (sarge only)  liboggz
1101  sitecopy (#395876)          - iceweasel <not-affected> (uses xulrunner)
1102  tla (etch/sid only: #395877)          - xulrunner <unfixed> (embed; bug #540959)
1103            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1104            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1105            - iceape <unfixed> (embed)
1106            [etch] - iceape <not-affected> (introduced in 2.0)
1107            [lenny] - iceape <not-affected> (introduced in 2.0)
1108    
1109  libmodplug:  liboggplay
1110  gst-plugins-bad0.10          - iceweasel <not-affected> (uses xulrunner)
1111            - xulrunner <unfixed> (embed; bug #540959)
1112            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1113            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1114            - iceape <unfixed> (embed)
1115            [etch] - iceape <not-affected> (introduced in 2.0)
1116            [lenny] - iceape <not-affected> (introduced in 2.0)
1117    
1118  libvncserver:  php-net-dnsbl
1119  vino          - serendipity <unfixed> (embed; bug #541740; package in NEW)
1120    
1121  putty:  php-onyx-rss
1122  filezilla          - serendipity <unfixed> (embed; bug #541740; wontfix: only one script, own package is overkill, appears not to be duplicated in Debian)
1123    
1124  tinyxml (not packaged in Debian):  php-text-wiki
1125  filezilla          - serendipity <unfixed> (embed; bug #541740; package in NEW)
1126    
1127    php-xml-rpc
1128            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1129    
1130    polarssl (does not have a shared library)
1131            - pdkim <itp> (embed; bug #543150)
1132            - xyssl <unfixed> (old-version)
1133    
1134    pidgin (libpurple)
1135            - gaim <removed> (old-version)
1136            - qutecom 2.2~rc3.hg396~dfsg1-6 (embed; bug #559785)
1137    
1138    icu
1139            - webkit 1.0.1-1 (embed; bug #547214)
1140            - texlive-bin <unfixed> (fork)
1141            NOTE: texlive upstream working with icu upstream to merge their changes
1142            - chromium-browser 5.0.375.29~r46008-3
1143    
1144    cyrus-imapd-2.2
1145            - kolab-cyrus-imapd <unfixed> (fork)
1146            - dovecot 1:1.2.1-1 (embed) [/dovecot-sieve/src/libsieve/*]
1147    
1148    python-cxx-dev
1149            - freecad 0.9.2646.3-1 (embed; bug #547936)
1150    
1151    zipios++
1152            - freecad 0.9.2646.3-1 (embed; bug #547941)
1153            - enigma 0.92.3-3 (embed)
1154            NOTE: likely fixed earlier, marking etch's version as fixed
1155    
1156    linux-2.6
1157            - kvm <removed> (embed; bug #549973) [./kernel/*]
1158            - linux-kbuild-2.6 <unfixed> (embed; bug #550379) [./kbuild/*]
1159            - kernel-source-2.6.8 <removed> (old-version)
1160            - kernel-source-2.4.27 <removed> (old-version)
1161            - kernel-source-2.4.24 <removed> (old-version)
1162            - kernel-source-2.2.25 <removed> (old-version)
1163            - kernel-source-2.2.20 <removed> (old-version)
1164    
1165    libfdt (not yet packaged separately for debian; http://www.jdl.com/software/)
1166            - kvm <removed> (embed) [./libfdt/*]
1167            - qemu-kvm <unfixed> (embed) [./libfdt/*]
1168    
1169    qweb (not packaged)
1170            - ajaxterm <unfixed>
1171    
1172    opensaml2
1173            - opensaml <removed> (old-version)
1174    
1175    shibboleth-sp2
1176            - shibboleth-sp <removed> (old-version)
1177    
1178    tuxonice-userui
1179            - suspend2-userui <removed> (old-version)
1180    
1181    expat
1182            - w3c-libwww <removed> (embed; bug #551941)
1183            [etch] - w3c-libwww <unfixed> (embed; bug #551941) [./modules/expat/*]
1184            - python-xml <unfixed> (embed; bug #551940) [./extensions/expat/*]
1185            - python2.5 <unfixable> (embed; bug #553403) [./Modules/expat/*]
1186            - python2.4 <unfixable> (embed; bug #553403)
1187            - python2.7 2.7-6 (embed)
1188            - python-4suite <unfixed> (embed; bug #516935)
1189            - wxwindows2.4 <removed> (embed)
1190            - wxwidgets2.6 2.6.3.2.2-4 (embed)
1191            - wxwidgets2.8 2.8.10.1-2 (embed)
1192            - albert <unfixed> (embed; bug #600974)
1193            - celementtree 1.0.5-8 (embed)
1194            NOTE: Maybe that was fixed even earlier
1195            - centerim <unfixed> (embed; bug #559783)
1196            - audacity 1.3.2-1 (embed)
1197            - matanza <unfixed> (embed)
1198            - tdom 0.8.3~20080525-1 (embed)
1199            - udunits 2.1.8-4 (embed)
1200            - apr-util 1.2 (embed)
1201            - ayttm <unfxed> (embed; bug #561006)
1202            - cableswig <unfixed> (embed)
1203            - cadaver <unfixed> (embed)
1204            - cmake 2.6.0-6 (embed)
1205            - coin3 <unfixed> (embed)
1206            - cvsnt <unknown> (embed)
1207            - dasher <unknown> (embed)
1208            - gdcm 2.0.14-2 (embed)
1209            - ghostscript 8.71~dfsg-2 (embed)
1210            - grmonitor <removed> (embed)
1211            - iceape <unfixed> (embed)
1212            - insighttoolkit 3.16.0-1 (embed)
1213            NOTE: insighttoolkit might've been fixed earlier
1214            - jabber <unknown> (embed)
1215            - libparagui1.1 1.0.2-1 (embed)
1216            - libspiff <unknown> (embed)
1217            - mcabber <unfixed> (embed; bug #601053)
1218            - paraview 3.6.2-1 (embed)
1219            - poco 1.3.6p1-1 (embed)
1220            - scorched3d <unknown> (embed)
1221            - simgear <unfixed> (embed)
1222            - sitecopy 1:0.16.0-1
1223            - smart <unfixed> (embed)
1224            NOTE: smart embeds celementree, and it includes expat
1225            - swish-e <not-affected> (Linked against libxml, which is used instead)
1226            - tla 1.3.5+dfsg-15 (embed)
1227            - vtk 4.1.20030227-1 (embed)
1228            - wbxml2 <not-affected> (expat code is only used on Mac OS X, see #560941)
1229            - xmlrpc-c <unfixed> (embed)
1230            - iceweasel <unfixed> (embed)
1231            - kompozer <unfixed> (embed)
1232            - vxl 1.13.0-2 (embed)
1233            - xulrunner <unfixed> (embed)
1234            - xmame <unknown> (embed)
1235            - apache2 2.2 (embed)
1236            - texlive-bin <not-affected> (Embedded code not compiled in)
1237            - vnc4 <unfixed> (embed)
1238            - xotcl 1.6.6-1 (embed)
1239            - chromium-browser 5.0.375.29~r46008-3
1240    
1241    xerces-c
1242            - xerces-c2 <unfixed> (old-version)
1243            - xerces27 <removed> (old-version)
1244    
1245    md5 (RSA's version; not the gnu version provided by coreutils)
1246            - w3c-libwww <removed> (embed; bug #551942)
1247            [etch] - w3c-libwww <unfixed> (embed; bug #551942) [./modules/md5/*]
1248    
1249    libparagui1.1
1250            - asc <unfixable> (fork)
1251    
1252    enet
1253            - sauerbraten <unfixed> (embed; #497194)
1254    
1255    eglibc
1256            - glibc <removed> (old-version)
1257            - mksh <unfixable> (static)
1258              NOTE: /bin/mksh-static only, and only on some arches (others use dietlibc)
1259    
1260    galib
1261            - gamera 3.2.3-1 (embed)
1262    
1263    configobj
1264            - bzr 2.1.0~rc2-1 (embed; bug #555336)
1265            - elisa <unfixed> (embed; bug #555337)
1266            - gaupol <unfixed> (embed; bug #555338)
1267            - ipython <unfixed> (embed; bug #555339)
1268            - pida <unfixed> (embed; bug #555340)
1269            - psychopy <unfixed> (embed; bug #555341)
1270            - rest2web <unfixed> (embed; bug #555342)
1271            - auth2db <unknown> (embed)
1272            - dynagen <unknown> (embed)
1273            - iceweasel <unknown> (embed)
1274            - sabnzbdplus <unknown> (embed)
1275            - xulrunner <unknown> (embed)
1276            - nipy <not-affected> (part of an example [/examples/neurospin/neurospy/configobj.py], which is not installed into binary packages)
1277    
1278    python-clientform
1279            - bibus <unfixed> (embed; bug #555332)
1280            - zope2.10 <unfixed> (embed; bug #555333)
1281            - zope2.11 <removed> (embed; bug #555334)
1282            - python-mechanize <unknown> (embed)
1283            - twill <unknown> (embed)
1284    
1285    python-mechanize
1286            - zope2.10 <unfixed> (embed; bug #555337)
1287            - zope2.11 <removed> (embed; bug #555338)
1288            - twill <unknown> (embed; bug #555339)
1289    
1290    pexpect
1291            - duplicity 0.6.06-1 (embed; bug #555361)
1292            - hplip <unfixed> (embed; bug #555362)
1293            - smart <unfixed> (embed; bug #555363)
1294    
1295    pyparsing
1296            - bauble <unfixed> (embed; bug #555366)
1297            - boa-constructor 0.6.1-8 (embed; bug #555367)
1298            - calibre <unfixed> (embed; bug #555368)
1299            - matplotlib <unfixed> (embed; bug #531024)
1300            - zhpy 1.7.3.1-1 (embed; bug #555370)
1301            - polybori <unknown> (embed)
1302            - python-whoosh <unknown> (embed)
1303            - twill <unknown> (embed)
1304            - zope-textindexng3 <unknown> (embed)
1305    
1306    python-pysqlite2
1307            - python2.4 <unfixed> (embed; bug #553403)
1308            - python2.5 <unfixed> (embed; bug #553403)
1309    
1310    celementtree
1311            - python2.5 <unfixed> (embed)
1312            - smart <unfixed> (embed)
1313    
1314    elementtree
1315            - python2.5 <unfixed> (embed)
1316            - python2.6 <unfixed> (embed)
1317            - bzr 2.1.0~rc2-1 (embed; bug #555343)
1318            - gedit 2.28.2-1 (embed; bug #555344)
1319            - smart <unfixed> (embed)
1320            - solfege <unfixed> (embed; bug #555345)
1321            - w3af <unfixed> (embed; bug #555346)
1322            - python-qt4 <unknown> (embed)
1323            - sphinx <unknown> (embed)
1324            - python-nltk <itp> (embed)
1325    
1326    python2.5
1327            - python2.4 <unfixed> (old-version)
1328            - jython <unfixed> (embed)
1329            NOTE: embeds many stdlib modules
1330            - python-django <unfixed> (embed; bug #555419)
1331            NOTE: embeds stdlib modules: doctest, decimal
1332            - gamera 3.2.3-1 (embed)
1333            NOTE: embeds stdlib modules: ConfigParser, optparse, sets, textwrap
1334            - boa-constructor <unfixed> (embed; bug #555426)
1335            NOTE: embeds stdlib modules: ConfigParser, tarfile, zipfile, xmlrpclib
1336            - nicotine <unfixed> (embed; bug #555427)
1337            NOTE: embeds stdlib modules: ConfigParser
1338            - museek+ <unfixed> (embed; bug #555428)
1339            NOTE: embeds stdlib modules: ConfigParser
1340            - vegastrike-data <removed> (embed)
1341            NOTE: embeds many stdlib modules
1342            - codespeak-lib 1.1.1-1 (embed; bug #555420)
1343            NOTE: embeds stdlib modules: doctest, optparse, subprocess, textwrap
1344            - config-manager <unfixed> (embed; bug #555423)
1345            NOTE: embeds stdlib modules: optparse
1346            - jhbuild 2.28.0-1 (embed; bug #555421)
1347            NOTE: embeds stdlib modules: optparse, subprocess
1348            - smart <unfixed> (embed; bug #555432)
1349            NOTE: embeds stdlib modules: optparse
1350            - pyprotocols 1.0a.svn20070625-5 (embed; bug #555433)
1351            NOTE: embeds stdlib modules: doctest
1352            - ruledispatch 0.5a.svn20080510-4 (embed; bug #555434)
1353            NOTE: embeds stdlib modules: doctest
1354            - distribute <unfixed> (embed)
1355            NOTE: embeds stdlib modules: doctest
1356            - python-setuptools <unfixed> (embed; bug #555435)
1357            NOTE: embeds stdlib modules: doctest
1358            - zope.testing <unfixed> (embed; bug #555436)
1359            NOTE: embeds stdlib modules: doctest
1360            - translate-toolkit <unfixed> (embed; bug #555422)
1361            NOTE: embeds stdlib modules: textwrap, contextlib
1362            - libtpclient-py <unfixed> (embed; bug #555424)
1363            NOTE: embeds stdlib modules: subprocess
1364            - grass <unfixed> (embed; bug #555425)
1365            NOTE: embeds stdlib modules: subprocess
1366            - coherence <unfixed> (embed; bug #555429)
1367            NOTE: embeds stdlib modules: uuid
1368            - python-django-extensions 0.4.2pre+git200911182050-1 (embed; bug #555430)
1369            NOTE: embeds stdlib modules: uuid
1370            - setroubleshoot <removed> (embed; bug #555431)
1371            NOTE: embeds stdlib modules: uuid
1372            - linkchecker <unfixed> (embed; bug #555414)
1373            NOTE: embeds msgfmt.py script
1374            - imdbpy <unfixed> (embed)
1375            NOTE: embeds msgfmt.py script
1376            - kiwi <unfixed> (embed)
1377            NOTE: embeds msgfmt.py script
1378            - moin <unfixed> (embed)
1379            NOTE: embeds msgfmt.py script, stdlib modules: cgitb, difflib, tarfile
1380            - plone3 <removed> (embed)
1381            NOTE: embeds msgfmt.py script
1382            - roundup <unfixed> (embed)
1383            NOTE: embeds msgfmt.py script, stdlib modules: cgitb
1384            - rednotebook <unfixed> (embed; bug #555415)
1385            NOTE: embeds msgfmt.py script
1386            - turbogears <unfixed> (embed)
1387            NOTE: embeds msgfmt.py script
1388            - elisa <unfixed> (embed)
1389            NOTE: embeds msgfmt.py script, stdlib modules: uuid
1390            - calibre <unfixed> (embed)
1391            NOTE: embeds msgfmt.py script, stdlib modules: zipfile
1392            - mailman 1:2.1.13-1 (embed; #555416)
1393            NOTE: embeds msgfmt.py script
1394            - python-docutils <unknown> (embed)
1395            NOTE: embeds stdlib modules: optparse, textwrap
1396            - python-imaging <unknown> (embed)
1397            NOTE: embeds stdlib modules: doctest
1398            - python-mechanize <unknown> (embed)
1399            NOTE: embeds stdlib modules: doctest
1400            - twill <unknown> (embed)
1401            NOTE: embeds stdlib modules: subprocess
1402            - zeroc-ice <unknown> (embed)
1403            NOTE: embeds stdlib modules: subprocess
1404            - wxwidgets2.8 <unknown> (embed)
1405            NOTE: embeds stdlib modules: subprocess
1406            - cycle <unknown> (embed)
1407            NOTE: embeds msgfmt.py script
1408            - deluge <unknown> (embed)
1409            NOTE: embeds msgfmt.py script
1410            - opendict <unknown> (embed)
1411            NOTE: embeds msgfmt.py script
1412            - openerp-client <unknown> (embed)
1413            NOTE: embeds msgfmt.py script
1414            - rapidsvn <unknown> (embed)
1415            NOTE: embeds msgfmt.py script
1416            - wammu <unknown> (embed)
1417            NOTE: embeds msgfmt.py script
1418            - gaphor <unknown> (embed)
1419            NOTE: embeds msgfmt.py script
1420            - pida <unknown> (embed)
1421            NOTE: embeds msgfmt.py script
1422            - python-formencode <unknown> (embed)
1423            NOTE: embeds msgfmt.py script
1424            - duplicity <unfixed> (embed)
1425            NOTE: embeds stdlib module: urlparse, tarfile
1426            - pygopherd <unfixed> (embed)
1427            NOTE: embeds stdlib module: zipfile
1428    
1429    argparse
1430            - twill <unfixed> (embed; bug #555347)
1431            - ipython <unfixed> (embed; bug #555348)
1432    
1433    coherence
1434            - elisa <unfixed> (embed; bug #555335)
1435    
1436    simpletal
1437            - plastex <unfixed> (embed; bug #555371)
1438    
1439    flickrpc (not packaged in Debian, http://burtonini.com/bzr/flickrpc/)
1440            - postr <unfixed> (embed)
1441            - elisa <unfixed> (embed)
1442    
1443    simplegeneric (not packaged in Debian, http://pypi.python.org/pypi/simplegeneric)
1444            - apertium-tolk <unfixed> (embed)
1445            - ipython <unfixed> (embed)
1446            - virtaal <unfixed> (embed)
1447    
1448    distribute
1449            - setuptools <removed> (old-version)
1450    
1451    rails
1452            - jruby1.2 <removed> (embed) [./bench/rails/*]
1453            NOTE: jruby is in non-free, it probably includes rails too
1454            - libgettext-ruby <unfixed> (embed) [./samples/rails/*]
1455            - libopenid-ruby <unfixed> (embed) [./examples/rails_openid/*]
1456            - thin <unfixed> (embed) [./spec/rails_app/*]
1457            NOTE: this is a subdirectory of examples, which in general is a non-issue, but may
1458            NOTE: be dangerous if developers are naively basing their code off of the examples
1459            NOTE: prototype.js is among the example files
1460    
1461    lucene2 (prototype.js is among the embeds in the following)
1462            - lucene <unfixed> (old-version)
1463            - pylucene <unfixed> (embed)
1464            - libpdfbox-java <unfixed> (embed)
1465            - libfontbox-java <unfixed> (embed)
1466            - libjempbox-java <unfixed> (embed)
1467            - solr <unfixed> (embed)
1468    
1469    unicode-data
1470            - syslinux <unfixed> (embed)
1471            - camomile <unfixed> (embed)
1472            - fribidi <unfixed> (embed)
1473            - m17n-db <unfixed> (embed)
1474            - sbcl <unfixed> (embed)
1475            - heimdal <unfixed> (embed)
1476            - icu <unfixed> (embed)
1477            - icu4j <unfixed> (embed)
1478            - krb5 <unfixed> (embed)
1479            - moodle <unfixed> (embed)
1480            - openldap <unfixed> (embed)
1481            - pike7.6 <unfixed> (embed)
1482            - samba <unfixed> (embed)
1483            - samba4 <unfixed> (embed)
1484            - cmucl <unfixed> (embed)
1485            - typo3-src <unfixed> (embed)
1486            - mauve <unfixed> (embed)
1487            - texlive-bin <unfixed> (embed)
1488            - ypsilon <unfixed> (embed)
1489            - jeuclid <unfixed> (embed)
1490            - charmap.app <unfixed> (embed)
1491            - clisp <unfixed> (embed)
1492            - gnulib <unfixed> (embed)
1493            - opensrs-client <unfixed> (embed)
1494            - saxonb <unfixed> (embed)
1495            - rails <unfixed> (embed)
1496    
1497    feedparser
1498            - rawdog <unfixed> (embed; bug #383422)
1499            - miro <unfixed> (embed; bug #555351)
1500            - calibre <unfixed> (embed; bug #555352)
1501            - freevo <unfixed> (embed; bug #555353)
1502            - pida <unfixed> (embed; bug #555354)
1503            - planet-venus <unfixed> (embed; bug #555355)
1504            - plone3 <removed> (embed; bug #555356)
1505            - exaile 0.2.14+debian-1 (embed)
1506            - screenlets 0.1.2-3 (embed)
1507            NOTE: included twice
1508    
1509    agg:
1510            - matplotlib <unfixed> (embed: bug #377271)
1511            - contextfree <unfixed> (embed)
1512            NOTE: since 2.2-1 it links statically to system libagg, but still uses the embedded copy
1513            - exactimage <unfixed> (embed)
1514            - python-enable <unfixed> (embed)
1515            - mapnik 0.5.1-3 (embed)
1516            NOTE: links statically to agg, but shared library is not available (bug #377271)
1517    
1518    vtk
1519            - paraview <unfixable> (embed; bug #495426)
1520    
1521    txt2tags
1522            - rednotebook <unfixed> (embed)
1523    
1524    htmltextview (not packaged in Debian, http://www.gnome.org/~gjc/htmltextview.py)
1525            - gajim <unfixed> (embed)
1526            - emesene <unfixed> (embed)
1527            - convirt <unfixed> (embed)
1528            - pida <unfixed> (embed)
1529            - rednotebook <unfixed> (embed)
1530    
1531    horde3 (prototype.js is among the embeds in the following)
1532            - mnemo2 <unfixed> (embed)
1533            - nag2 <unfixed> (embed)
1534            - wordpress <unfixed> (embed)
1535            NOTE: Text_Diff (wp-includes/Text/Diff*)
1536    
1537    cimg
1538            - gmic <unfixed> (embed)
1539    
1540    mootools
1541            - kdenetwork <unfixed> (embed)
1542            - gallery <unfixed> (embed)
1543            - jspwiki <unfixed> (embed)
1544            - vdr-plugin-live <unfixed> (embed)
1545            - perl-doc-html <unfixed> (embed)
1546    
1547  gv:  openldap
1548  evince (ps/ tree from gv 3.5.8)          - openldap2.3 <removed> (old-version)
 evince-gtk (not packaged in Debian)  
1549    
1550  libXbae:  grub2
1551  libpawlib2-lesstif package (from Cernlib)          - grub <unfixed> (old-version)
1552    
1553  libXaw:  gnupginterface
1554  libpawlib2-lesstif package (from Cernlib)          - duplicity <unfixed> (embed)
1555    
1556  (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  python-dateutil
1557            - awn-extras-applets <unfixed> (embed)
1558            - matplotlib <unknown> (embed)
1559    
1560    cups
1561            - cupsys <removed> (old-version)
1562    
1563    yui
1564            - bcfg2 <not-affected> (present in source but not included in any binary files)
1565            - serendipity 1.5.3-1 (embed; bug #557746)
1566            - moodle 1.8.2.dfsg-5 (embed)
1567            - jifty 0.91117-1 (embed; bug #557748)
1568            - webgui 7.7.26-1 (embed)
1569            - loggerhead 1.17-1 (embed)
1570            - otrs2 2.4.7+dfsg1-1 (embed; bug #592146)
1571    
1572    quake3 (vanilla source not packaged in debian)
1573            - openarena <unfixable> (fork)
1574    
1575    quake2 (vanilla source not packaged in debian)
1576            - alien-arena <unfixable> (fork)
1577            - warsow <unfixable> (fork)
1578    
1579    libtheora
1580            - iceweasel <not-affected> (uses xulrunner)
1581            - xulrunner <unfixed> (embed; bug #540959)
1582            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1583            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1584            - iceape <unfixed> (embed; bug #559276)
1585            [etch] - iceape <not-affected> (introduced in iceape 2.0)
1586            [lenny] - iceape <not-affected> (introduced in iceape 2.0)
1587    
1588    dtoa
1589            - bfilter <unfixed> (embed)
1590            - cacao <removed> (embed)
1591            - cdrdao <unfixed> (embed)
1592            - classpath <unfixed> (embed)
1593            - freej <unfixed> (embed)
1594            - iceape <unfixed> (embed)
1595            - iceweasel <unfixed> (embed)
1596            - jscoverage <unfixed> (embed)
1597            - kde4libs <unfixed> (embed)
1598            - kdelibs <unfixed> (embed)
1599            - kompozer <unfixed> (embed)
1600            - libv8 <unfixed> (embed)
1601            - mono <unfixed> (embed)
1602            - newlib <unfixed> (embed)
1603            - nspr <unfixed> (embed)
1604            - php5 <unfixed> (embed)
1605            - polyml <unfixed> (embed)
1606            - qt4-x11 <unfixed> (embed)
1607            - rhino <unfixed> (embed)
1608            NOTE: code translated to Java
1609            - ruby1.8 <unfixed> (embed)
1610            - ruby1.9 <unfixed> (embed)
1611            - ruby1.9.1 <unfixed> (embed)
1612            - sdd <unfixed> (embed)
1613            - sfind <unfixed> (embed)
1614            - star <unfixed> (embed)
1615            - tinymux <unfixed> (embed)
1616            - virtualbox-ose <unfixed> (embed)
1617            - webkit <unfixed> (embed)
1618            - xulrunner <unfixed> (embed)
1619    
1620    ipc (not packaged in Debian; see http://mozdev.org/pipermail/enigmail/2009-November/011678.html)
1621            - firegpg <unfixed> (embed)
1622            - enigmail <unfixed> (embed)
1623    
1624    ptmalloc (not packaged in Debian)
1625            - crystalspace <unfixed> (embed)
1626            - qt4-x11 <unfixed> (embed)
1627    
1628  libgd2:  svgalib
1629  graphviz (lib/gd seems to be 2.0.33)          - usplash <unfixed> (embed)
1630    
1631  rar:  bogl
1632  unrar-nonfree          - usplash <unfixed> (embed)
1633    
1634  unrar-free: (maybe this code is derived from the original rar, too?)  taglist
1635  clamav (seems to be disabled in default config)          - usplash <unfixed> (embed)
1636    
1637  mplayer (DirectMedia Object loader):  portaudio
1638  xine-lib (src/libw32dll/)          - audacity <unfixed> (embed; bug #323711)
 vlc (modules/codec/dmo/)  
1639    
1640  libwpd (WordPerfect converter):  nyquist
1641  openoffice.org          - audacity <unfixed> (embed)
1642            NOTE: embeds a forked nyquist with support for a shared library
1643    
1644  fsplib (http://sourceforge.net/projects/fsp/):  vamp-plugin-sdk
1645  gftp (lib/fsplib version 0.3)          - audacity <unfixed> (embed)
1646    
1647    wordpress
1648            - libwordpress-xmlrpc-perl <removed> (embed) [./xmlrpc.php]
1649            - wordpress-mu <removed> (fork)
1650    
1651  librpcsecgss:  php5
1652  krb5          - php4 <removed> (old-version)
1653    
1654    classpath
1655            - libgnucrypto-java <removed> (embed; bug #559788)
1656    
1657    libtool
1658            - apr <unfixed> (static; bug #489625)
1659            NOTE: ships copy of libtool in libapr1-dev; was 'embed' before 1.3.2-3
1660            - arts <unfixed> (embed)
1661            - bochs 2.4.2-1 (embed; bug #560884)
1662            - camserv <unfixed> (embed)
1663            - collectd 4.8.2-1 (embed)
1664            - courier-authlib 0.58-4 (embed)
1665            NOTE: The etch version of courier-authlib was the earliest version checked, might be fixed earlier
1666            - cvsnt 2.5.04.3236-1.2 (embed)
1667            - dico <not-affected> (Uses the system copy of ltdl)
1668            - freeradius 0.1+20010527-1 (embed)
1669            NOTE: Earliest reference I could find from the changelog is from 27 May 2001
1670            - ggobi 2.1.9~20091212-1 (embed)
1671            - glame 2.0.1-4 (embed)
1672            NOTE: The etch version of glame was the earliest version checked, might be fixed earlier
1673            - gnash 0.8.7-2 (embed)
1674            - gnu-smalltalk <unfixed> (embed; bug #566777)
1675            - google-gadgets 0.10.5-0.3 (embed)
1676            NOTE: 0.10.5-0.3 was the earliest version checked, was fixed earlier
1677            - graphicsmagick 1.3.5-6 (embed)
1678            - graphviz 2.8-3 (embed)
1679            NOTE: The etch version of graphviz was the earliest version checked, might be fixed earlier
1680            - guile-1.6 1.6.8-7 (embed)
1681            - hamlib 1.2.11-1 (embed)
1682            - hercules 3.06-1.2 (embed)
1683            - jags 1.0.4-3 (embed; bug #560864)
1684            - kdelibs <unfixed> (embed)
1685            - libannodex <removed> (embed)
1686            - libextractor 0.5.23+dfsg-4 (embed)
1687            - libmcrypt <not-affected> (libtool source present but not included in any of the binary packages)
1688            - libtunepimp 0.5.3-7.3 (embed)
1689            - mp4h 1.3.1-4.1 (embed)
1690            - naim <removed> (embed)
1691            - parser-mysql <unfixed> (embed)
1692            - pinball 0.3.1-11 (embed)
1693            - redland <unfixed> (embed)
1694            - siproxd <unfixed> (embed)
1695            - ski <unfixed> (embed)
1696            - synfig 0.62.00-1 (embed)
1697            - unixodbc 2.2.4-5 (embed)
1698            - xmlsec1 <not-affected> (Doesn't enable dynamic loading of crypto modules)
1699            - clamav 0.95+dfsg-1 (embed)
1700            - imagemagick 6:6.2.3.1-1 (embed)
1701            - hypre 2.4.0b-5 (embed)
1702            - lam <unfixed> (embed)
1703            - openmpi <unfixable> (embed; bug #559386)
1704            - parser <unfixed> (embed)
1705            - pdsh 2.18-5 (embed; bug #560892)
1706            - sbnc 1.2-8 (embed)
1707            - sdcc <unfixed> (embed)
1708            - wml <not-affected> (The embedded ltdl isn't used, instead mp4h is used, see 559841)
1709            - proftpd-dfsg <unfixed> (embed; bug #561748)
1710            - babel 1.4.0.dfsg-5 (embed)
1711            - libprelude 0.9.14-2 (embed)
1712            - heartbeat 2.1.4-7 (embed)
1713            NOTE: From Squeeze onwards the system copy of ltdl is used, use the current version from Squeeze,
1714            NOTE: might've been fixed earlier
1715            - gcc-* <unknown> (embed)
1716    
1717    ocamlgsl
1718            - orpie 1.5.1-7.1 (embed; bug #550058)
1719    
1720    xdotool
1721            - keynav <unfixed> (embed; bug #560103)
1722    
1723    bulletphysics (not packaged; http://www.bulletphysics.org/)
1724            - supertuxkart <unfixed> (embed)
1725            - blender <unfixed> (embed)
1726    
 jasper:  
1727  ghostscript  ghostscript
1728  gs-gpl          - gs-gpl <removed> (old-version)
1729    
1730  libidn:  icedove
1731  monotone          - thunderbird <removed> (old-version)
1732    
1733  liblua:  sizzlejs (not packaged in Debian, http://sizzlejs.com/)
1734  monotone          - jquery <unfixed> (embed)
1735    
1736  libbotan:  sed
1737  montone          - ssed <unfixed> (fork)
1738    
1739    phpatomlib (http://code.google.com/p/phpatomlib)
1740            - wordpress <unfixed> (embed)
1741    
1742    Services_JSON (http://pear.php.net/package/Services_JSON)
1743            - wordpress <unfixed> (embed)
1744    
1745    phpass (http://www.openwall.com/phpass/)
1746            - gallery2 <unfixed> (embed)
1747            - wordpress <unfixed> (embed)
1748            - typo3-src <unfixed> (modified-embed)
1749            NOTE: file refers to drupal, maybe there's a copy somewhere there
1750            NOTE: a copyright owner search didn't match anything
1751            - libauthen-passphrase-perl <unfixable> (fork)
1752            NOTE: perl implementation of phpass
1753    
1754    squirrelmail
1755            - wordpress <unfixed> (embed)
1756            NOTE: class-pop3.php
1757    
1758    ezSQL (http://www.woyano.com/jv/ezsql)
1759            - wordpress <unfixable> (fork)
1760            NOTE: wp-db.php
1761    
1762    Diff.php (Clay Loveless' version/killersoft.com)
1763            - php-versioncontrol-svn <unfixed>
1764    
1765    libm (provided by libc)
1766            - spring <unfixed> (embed)
1767            NOTE: embedded by embedded copy of streflop
1768            - aide <unfixed> (static)
1769            - busybox <unfixed> (static)
1770            - mindi-busybox <unfixed> (static)
1771            - qemu <unfixed> (static)
1772            NOTE: qemu-user-static
1773            - tuxonice-userui <unfixed> (static)
1774            - zsh <unfixed> (static)
1775            NOTE: zsh-static
1776            - tripwire <unfixed>
1777    
1778    streflop
1779            - spring <unfixed> (embed)
1780    
1781  NetXX:  minizip
1782  monotone          - spring <unfixed> (embed)
1783    
1784  libgc:  oscpack
1785  mono          - spring <unfixed> (embed)
1786    
1787    hpiutil2
1788            - spring <unfixed> (embed)
1789    
 lzma:  
1790  p7zip  p7zip
1791            - spring <unfixed> (embed)
1792    
1793  lzo:  pythonqt (doesn't seem to be python-qtN, unknown source)
1794  grub2          - fontmatrix <unfixed> (embed)
1795            - elmerfem <unfixed> (embed)
1796    
1797  pax code:  iepngfix (not packaged in Debian; http://www.twinhelix.com/css/iepngfix/)
1798  tar          - docvert <unfixed> (embed)
1799  cpio          - jifty <unfixed> (embed)
1800            - kdenetwork <unfixed> (embed)
1801            - mediatomb <unfixed> (embed)
1802            - plastex <unfixed> (embed)
1803            - plone3 <removed> (embed)
1804            - python-chaco <unfixed> (embed)
1805            - python-docutils <unfixed> (embed)
1806            - s5 <unfixed> (embed)
1807            - zope2.10 <unfixed> (embed)
1808            - zope2.11 <removed> (embed)
1809            - cython <not-affcted> (embed)
1810            NOTE: part of documentation, which is not installed into the binary package
1811    
1812    python-docutils
1813            - zope2.10 <unfixed> (embed)
1814            - zope2.11 <removed> (embed)
1815    
1816    tesseract
1817            - ocropus <unfixed> (static)
1818    
1819    antlr
1820            - kdevelop <unfixed> (embed)
1821    
1822    libxerces2
1823            - openjdk-6 <unfixed> (embed)
1824    
1825    kfreebsd-8
1826            - kfreebsd-7 <unfixed> (old-version)
1827            - kfreebsd-6 <removed> (old-version)
1828    
1829    ruby1.9.1
1830            - ruby1.9 <unfixed> (old-version)
1831            - ruby1.8 <unfixed> (old-version)
1832    
1833    maildrop
1834            - courier <unfixed> (embed) [./maildrop]
1835    
1836    glee
1837            - warzone2100 <not-affected> (embed)
1838    
1839    phing
1840            - symfony <unfixed> (embed)
1841    
1842    pake
1843            - symfony <unfixed> (embed)
1844    
1845    propel
1846            - symfony <unfixed> (embed)
1847    
1848    creole
1849            - symfony <unfixed> (embed)
1850    
1851    hfsutils
1852            - cdrkit <unfixed> (embed; bug #570187)
1853            NOTE: embeds hfsutils code in genisoimage
1854    
1855    cdrkit
1856            - grub2 <unfixed> (embed; bug #570156)
1857            NOTE: genisoimage imported into grub-mkisofs
1858    
1859    kdebase-workspace
1860            - kdebase <unfixed> (old-version)
1861    
1862    file
1863            - php5 <unfixable> (modified-embed)
1864            [lenny] - php5 <not-affected>
1865    
1866    cdb
1867            - php5 <unfixed> (embed)
1868    
1869    libmbfl (itp: #570708)
1870            - php5 <unfixed> (embed)
1871            NOTE: PHP is actually the current upstream, ITP is of that code
1872    
1873    libonig
1874            - php5 5.3.2-1 (embed)
1875    
1876    xmlrpc-epi
1877            - php5 <unfixed> (embed)
1878    
1879    swt-gtk
1880            - eclipse <unfixed> (embed; bug #538808)
1881    
1882    txt2html
1883            - wml 2.0.11ds2-1 (embed)
1884    
1885    ca-certificates
1886            - nss <not-affected> (certificates are in source, but not included in any of the binary packages)
1887    
1888    openexr
1889            - freeimage <unfixed> (embed)
1890    
1891    libmng
1892            - freeimage <unfixed> (embed)
1893    
1894    openjpeg
1895            - freeimage <unfixed> (embed)
1896    
1897    libjpeg6b
1898            - freeimage <unfixed> (embed)
1899    
1900    libjpeg (don't know what exact version)
1901            - dcmtk <unfixed>
1902            - gdcm <unfixed>
1903            - insighttoolkit <unfixed>
1904            - openarena 0.8.5-5+exp1 (bug #495966)
1905            - outguess <unfixed>
1906            - squeak-vm <unfixed> (embed)
1907            - tremulous <unfixed>
1908            - tuxonice-userui <unfixed> (static)
1909            - fpc <unfixed> (static)
1910            - lazarus <unfixed> (static)
1911            NOTE: inherited from fpc, see #472304
1912            - mseide-msegui <unfixed> (static)
1913            NOTE: inherited from fpc, see #472304
1914            - easymp3gain <unfixed> (static)
1915            NOTE: inherited from fpc, see #472304
1916            - winff <unfixed> (static)
1917            NOTE: inherited from fpc, see #472304
1918            - texlive-bin <not-affected> (included in upstream source as dependency of libgd2, but not built or included in any of the binary packages)
1919    
1920    
1921    lxr
1922            - lxr-cvs <unfixed> (embed)
1923    
1924    libfile-copy-recursive-perl
1925            - r-base <unfixed> (embed; bug #577427)
1926            - r-base-core-ra <unfixed> (embed; bug #577429)
1927    
1928    delimmatch
1929            - r-base <unfixed> (embed; bug #577433)
1930            - r-base-core-ra <unfixed> (embed; bug #577434)
1931    
1932    libsmf (ITP: #572558)
1933            - denemo <unfixed> (embed)
1934            NOTE: http://lists.debian.org/debian-mentors/2010/04/msg00269.html
1935    
1936    libselinux
1937            - dpkg 1.15.6 (static)
1938    
1939    xinha (ITP: #479708)
1940            - horde3 <unfixed>
1941            - serendipity <unfixed>
1942            - openacs <unfixed>
1943            - dotlrn <unfixed>
1944    
1945    dvipng
1946            - texlive-bin <not-affected> (code present in source but not included in the binary packages)
1947    
1948    dvipdfmx
1949            - texlive-bin <unfixed> (embed)
1950            NOTE: this is intentionally part of the package now, and the separate dvipdfmx package has been removed from sid/squeeze
1951    
1952    lcdf-typetools
1953            - texlive-bin 2009-1 (embed)
1954    
1955    tex4ht
1956            - texlive-bin 2009-1 (embed)
1957    
1958    freetype
1959            - texlive-bin 2009-1 (embed)
1960    
1961    freetype2
1962            - texlive-bin 2009-1 (embed)
1963    
1964    silgraphite
1965            - texlive-bin <unfixed> (embed)
1966    
1967    unzip
1968            - texlive-bin 2009-1 (embed)
1969    
1970    jbig2dec
1971            - ghostscript 8.71~dfsg2-1 (embed)
1972    
1973    libxml2
1974            - chromium-browser 5.0.375.29~r46008-1
1975    
1976    protobuf
1977            - chromium-browser 5.0.375.70~r48679-2
1978    
1979    libv8
1980            - chromium-browser 5.0.375.38~r46659-1
1981    
1982    nspr
1983            - chromium-browser 5.0.375.29~r46008-3
1984    
1985    yasm
1986            - chromium-browser 5.0.375.29~r46008-2
1987    
1988    libxslt
1989            - chromium-browser 5.0.375.29~r46008-1
1990    
1991    miniupnpc (not packaged in Debian; ITP bug #444392)
1992            - warzone2100 <unfixed> (embed)
1993    
1994    iniparser (not packaged in Debian; RFP bug #582657)
1995            - warzone2100 <unfixed> (modified-embed)
1996    
1997    pyglet
1998            - sympy <unfixed> (embed; bug #459716)
1999    
2000    mpmath
2001            - sympy <unfixed> (embed; bug #541746)
2002    
2003  t1lib:  curl
2004  tetex-bin (links to system t1lib since 2.0.2)          - criticalmass <unfixed> (static; bug #599061)
2005  texlive-bin (links to system t1lib)          - wengophone <unknown> (embed)
2006    
2007    lib3ds
2008            - boson <unfixed> (embed; bug #600900)
2009            - openscenegraph <unfixed> (embed; bug #601181)

Legend:
Removed from v.7830  
changed lines
  Added in v.15513

  ViewVC Help
Powered by ViewVC 1.1.5