/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 7924 by stef-guest, Mon Jan 14 23:05:37 2008 UTC revision 15416 by iuculano, Mon Oct 4 10:02:06 2010 UTC
# Line 1  Line 1 
1  Embedded code copies  Embedded code copies
2  ====================  ====================
3    
4  This file collects cases, where a source package embeds code from  This file collects source packages that embed code from other projects.
5  other projects which is considered bad for fixing security flaws  This is considered bad for fixing security flaws because the fix needs
6  because the fix needs to be applied in multiple source packages.  to be applied in multiple source packages.
7    
8  Format:  Format:
9  <srcpkg> (<optional comment about srcpkg>)  <srcpkg> (<optional comment about srcpkg>)
10          - <embedding srcpkg> <status> (<sort>; bug #<number>)          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11          NOTE: optional comments about the linkage of the embedding srcpkg          NOTE: optional comments about the linkage of the embedding srcpkg
12    
13  status: version number fixing the embedded copy, <unfixed>, <removed>, <itp> or <unknown> if the version number can not be determined  status: version number fixing the embedded copy
14            <unfixed> if the issue is not yet fixed
15            <removed> if the package was removed from the archive
16            <itp> if the package is in the process of being packaged
17            <not-affected> if the package does not use the embedded copy
18            <unknown> if the version number can not be determined
19            <unfixable> for unavoidable cases (e.g., forks that add real value)
20  sort: static (linking statically against a lib)  sort: static (linking statically against a lib)
21        embed (embedding a copy of the library into another source package)        embed (embeds a copy of the library into another source package)
22        fork (the package is not just embedding code but it is a fork and thus might share parts of the source code)        modified-embed (embeds a code copy that differs from upstream code)
23          fork (a full-blown fork of another source package)
24          old-version (an older version of essentially the same code)
25    
26  The srcpkg might be some string to identify the code if there is no specific source package.  The srcpkg might be some string to identify the code if there is no
27    specific source package.
28    
29  Everything up to the next line is ignored  Everything up to the next line is ignored.
30  ---BEGIN  ---BEGIN
31  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)  poppler
         NOTE: Fixed packages link to poppler library unless otherwise noted  
         - gpdf <removed>  
         [sarge] - gpdf <unfixed>  
         NOTE: has been replaced by evince in etch  
32          - pdftohtml <unknown>          - pdftohtml <unknown>
33          [sarge] - pdftohtml <unfixed>          [sarge] - pdftohtml <unfixed>
34          [etch] - pdftohtml <unfixed>          [etch] - pdftohtml <unfixed>
35          NOTE: has been replaced by poppler-utils          NOTE: has been replaced by poppler-utils
36          - kdegraphics <unfixed> (embed; bug #436164)          - kdegraphics 4:4.2.2-1 (embed; bug #436164)
37          NOTE: the kpdf replacement in KDE 4 is using poppler          - texlive-base 3.0-12 (embed)
         - tetex-bin 3.0-12 (embed)  
38          - texlive-bin 2007-1 (embed)          - texlive-bin 2007-1 (embed)
39          NOTE: links to poppler          - koffice 1:2.0.0-1 (embed; bug #436163)
         - koffice <unfixed> (embed; bug #436163)  
40          - libextractor 0.5.12-1 (embed)          - libextractor 0.5.12-1 (embed)
41          NOTE: libextractor is using its own pdf decoder now          NOTE: libextractor is using its own pdf decoder now
         - libextractor 0.5.12-1 (embed)  
         - pdfkit.framework 0.8-4 (embed)  
42          - ipe <unfixed> (embed)          - ipe <unfixed> (embed)
43          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
44          - ruby-gnome2 <unknown> (embed)          - ruby-gnome2 <unknown> (embed)
45          NOTE: copy only present in source but links to poppler          - pdfedit <unfixed> (embed; bug #510794)
46            - swftools <removed> (embed; bug #551293)
47            - xpdf 3.02-9 (fork)
48    
49    pdksh (no longer developed since 1999)
50            - mksh <unfixable> (fork)
51            - posh <unfixable> (fork)
52    
53  ppmd  ppmd
54          - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)          - libcomplearn-mod-ppmd <unfixed> (fork)
55            NOTE: discussion in #458152
56    
57    libevent
58            - transmission 1.71-1 (embed; bug #529372)
59            - chromium-browser 5.0.375.29~r46008-1
60    
61    lrmi
62            - read-edid 2.0.0-1 (embed; bug #495131)
63            - s3switch <unfixed> (embed)
64            - xresprobe <unfixed> (embed)
65            - zhcon <unfixed> (embed)
66    
67    php-htmlpurifier
68            - mahara 1.2.5-1 (embed)
69            - knowledgeroot 0.9.9.5-5 (embed)
70            - moodle <unfixed> (embed)
71    
72    peercast
73            - gnome-peercast <removed> (embed)
74            [etch] - gnome-peercast <unfixed> (embed)
75    
76  silc-toolkit  silc-toolkit
77          - silc-client 1.1~beta6-1 (embed)          - silc-client 1.1~beta6-1 (embed)
78    
79    icclib
80            - ghostscript <unfixed> (embed)
81            - argyll <unfixed> (embed)
82    
83    libusb
84            - argyll <unfixed> (embed)
85    
86  dietlibc  dietlibc
87          - ccontrol 0.9.1+20071204-1 (static)          - ccontrol 0.9.1+20071204-1 (static)
88            - mksh <unfixable> (static)
89            NOTE: /bin/mksh-static only, and only on some arches (others use eglibc)
90    
91    libmikmod
92            - sdl-mixer1.2 <unfixed> (embed)
93            TODO: report bug
94    
95  libiax  libiax
96          - iaxmodem <unfixed> (embed)          - iaxmodem <unfixable> (embed; bug #548885)
97    
98    spandsp
99            - iaxmodem <unfixable> (embed; bug #548885)
100    
101    python-paramiko
102            - fabric 0.9.0-2 (embed; bug #561398)
103    
104  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
105          - dpkg <unfixed> (embed)          - dpkg 1.15.6 (static)
106          NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion          NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
107          - rsync <unfixed> (embed)          - rsync <unfixed> (embed)
108            - cherokee <unfixed> (embed)
109          NOTE: somehow derived code base          NOTE: somehow derived code base
110          - mono <unfixed> (embed)          - mono <unfixed> (embed)
111          TODO: check mozilla          TODO: check mozilla
# Line 67  zlib (lots of apps embed a copy, but lin Line 114  zlib (lots of apps embed a copy, but lin
114          - mrtg 2.12.2-1 (embed)          - mrtg 2.12.2-1 (embed)
115          - rpm <unknown> (embed)          - rpm <unknown> (embed)
116          NOTE: pinged anibal since when rpm was fixed          NOTE: pinged anibal since when rpm was fixed
117            - tuxcmd-modules <unfixed> (embed)
118            - zsync <unfixed>
119            - tra <unfixed>
120            - sash <unfixed>
121            - nsis <unfixed>
122            - pyfits 1:2.3.1-1
123            - mseide-msegui <unfixed>
124            NOTE: mseide
125            - mirrordir <unfixed>
126            - poco <unfixed>
127            - klibc <unfixed>
128            - emboss <unfixed>
129            - ghostscript <unfixed>
130            - freeimage <unfixed>
131            - clamav <unfixed> (fork)
132            NOTE: from the changelog: "libclamav6 does indeed duplicate parts of the zlib code, but there is not way around that"
133            - tuxonice-userui <unfixed> (static)
134            - plt-scheme <unfixed>
135            - perl <unfixed>
136            - paraview <unfixed>
137            - velvet 0.7.56~nozlibcopy-1
138            - gcvs <unfixed>
139            - dump <unfixed>
140            - aide <unfixed> (static)
141            - dar <unfixed> (static)
142            - avfs <unfixed>
143            - fpc <unfixed>
144            - winff <unfixed>
145            NOTE: inherited from fpc, see #472304
146            - lazarus <unfixed>
147            NOTE: inherited from fpc, see #472304
148            - erlang <unfixed> (embed)
149            - gamera 3.2.3-1 (embed)
150            - python2.4 <unfixed> (embed; bug #553403)
151            - python2.5 <unfixed> (embed; bug #553403)
152            - texlive-bin <unknown> (embed)
153    
154    dulwich
155            - hg-git 0.1.0-1 (embed; bug #541996)
156    
157    libvigraimpex
158            - hugin <unfixed> (embed; bug #542259)
159            - enblend-enfuse <unfixed> (embed; bug #542258)
160            - gamera 3.2.3-1 (embed)
161    
162  libbz2  libbz2
163          - dpkg <unfixed> (static)          - dpkg 1.15.6 (static)
164            - amd64-libs <unfixed> (static)
165  ekg          NOTE: let's call it "static"
166          - centericq <unfixed> (embed)          - dar <unfixed> (static)
167          - gaim <unfixed> (embed)          - dump <unfixed> (static)
168          - pigdin <unfixed> (embed)(links dynamically against libgadu)          - unalz 0.64-1 (embed)
169          - kopete 4:3.3.2-5 (embed)          NOTE: has code, by the maint, to use the system version but links against the internal copy
170          - kadu <unfixed> (embed)          - clamav <unfixed> (embed)
171          - gadu <unfixed> (embed)          NOTE: libclamav/nsis/bzlib*
172          NOTE: g/kadu not packaged in Debian yet          - pristine-tar <unfixable> (modified-embed)
173            NOTE: compression code only, not uncompression
174    
175    libyahoo2
176            - centerim <unfixed> (embed; bug #559783)
177    
178    libmsn
179            - centerim <unfixed> (embed; bug #559783)
180    
181    libgadu
182            - centerim <unfixed> (embed; bug #559783)
183            - pidgin <not-affected> (links dynamically since initial release; fixed in gaim)
184            - gaim 1:2.0.0+beta3-3 (embed; bug #360280)
185            - kdenetwork 4:3.3.2-5 (embed)
186            NOTE: from kdenetwork: kopete
187            - ekg 1:1.8~rc0-1 (embed)
188            - kadu 0.6.0.2-3 (embed; bug #504430)
189            - gadu <itp> (embed)
190    
191  xmlrpc (which package is the "origin" of this code?)  xmlrpc (which package is the "origin" of this code?)
192          - drupal <unfixed> (embed)          - drupal <unfixed> (embed)
193          - phpgroupware <unfixed> (embed)          - phpgroupware <unfixed> (embed)
194          - egroupware <unfixed> (embed)          - egroupware <unfixed> (embed)
195          - phpwiki (embed)          - phpwiki <unfixed> (embed)
196          - php4 <unfixed> (embed)          - php4 <removed> (embed)
197          TODO: check, php-pear, IIRC this was reorganized some weeks ago?          TODO: check, php-pear, IIRC this was reorganized some weeks ago?
198    
199  shtool (affects build-time only)  shtool (affects build-time only)
200          - mysql-ocaml <unfixed> (embed)          - mysql-ocaml <unfixed> (embed)
201          - php4 <unfixed> (embed)          - php4 <removed> (embed)
202            - php5 <unfixed> (embed)
203    
204  mozilla source code  xulrunner
205          - mozilla-firefox <unfixed> (embed)          - iceape <unfixed> (embed; bug #561749)
206          - mozilla-thunderbird          - iceweasel 2.0.0.19 (embed)
207          - firefox <removed>          - icedove <unfixed> (embed; bug #561750)
208          [etch] - firefox <unfixed> (embed)          - kompozer <unfixed> (embed; bug #532168)
209          - thunderbird <removed>          - galeon 2.0.2-4 (embed)
210          [etch] - thunderbird <unfixed> (embed)          - epiphany-browser 2.14.3-8 (embed)
211          - iceweasel <unfixed> (embed)          - conkeror 0.9~git080629-2 (embed)
212          - iceape <unfixed> (embed)          - kazehakase 0.4.2-1 (embed)
         - icedove <unfixed> (embed)  
         - xulrunner <unfixed> (embed)  
         - nvu <removed> (embed)  
213    
214  xli  xli
215          - xloadimage <unfixed> (embed)          - xloadimage <unfixed> (embed)
216    
217  lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)  lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
218          - openmotif <unfixed> (embed)          - openmotif <unfixed> (embed)
219          - xfree86/xorg <unfixed> (embed)  
220          NOTE: in libxpm  libxpm
221            - lesstif2 <unfixed> (embed; bug #575750)
222    
223  kerberized apps with BSD origin  kerberized apps with BSD origin
224          - krb4 <unfixed> (embed)          - krb4 <removed> (embed)
225          - krb5 <unfixed> (embed)          - krb5 <unfixed> (embed)
226          - heimdal <unfixed> (embed)          - heimdal <unfixed> (embed)
227    
228  grip (which pkg is the origin?)  grip (which pkg is the origin?)
229          - libcdaudio          - libcdaudio <unfixed>
230          - grip          - grip <unfixed>
231          - gnome-vfs          - gnome-vfs <unfixed>
232          TODO: check vfs2 as well          TODO: check vfs2 as well
233    
234  fudforum  fudforum
235          - phpgroupware-fudforum <unfixed> (embed)          [etch] - phpgroupware <unfixed> (embed)
236          - egroupware-fudforum <removed>          NOTE: phpgroupware-fudforum
237          [sarge] - egroupware-fudforum <unfixed> (embed)          [sarge] - egroupware-fudforum <removed> (embed)
238    
239    libbsd
240            - rdate 1:1.2-3 (embed)
241            - atheme-services <unfixed>
242            - libbsd-arc4random-perl <not-affected> (modified-embed)
243            NOTE: code not used, it links dynamically against libbsd instead
244            - isakmpd <unfixed>
245            - bsdgames <unfixed> (embed)
246            - bsd-mailx <unfixed> (embed)
247            - netcat-openbsd <unfixed> (embed; bug #550611)
248            - openssh <unfixed> (embed)
249            - unworkable <unfixed> (embed)
250            - mksh <unfixed> (modified-embed)
251            NOTE: strlcpy(), only used in /bin/mksh-static on eglibc arches
252            NOTE: FIXME, we should only have one entry: - mksh <not-affected> (modified-embed)
253            NOTE: strlcpy() on dietlibc arches; {g,s}etmode(); both unused
254    
255  cvs  cvs
256          - gcvs <unfixed> (embed)          - gcvs <unfixed> (embed)
257          NOTE: see cvsunix/src in tarball          NOTE: see cvsunix/src in tarball
258    
259  pcre  pcre3
260          - python* <unfixed> (embed)          - php4 <removed> (embed)
         - php4 <unknown> (embed)  
261          - analog 2:5.23-0woody1 (embed)          - analog 2:5.23-0woody1 (embed)
262          - libgoffice-1 <unfixed> (embed)          - goffice <unfixed> (embed)
263            NOTE: libgoffice-*
264          - vfu 4.06-4.1 (embed; bug #450754)          - vfu 4.06-4.1 (embed; bug #450754)
265          - tf5 5.0beta7-1 (embed)          - tf5 5.0beta7-1 (embed)
266          - monotone <unfixed> (embed)          - monotone 0.43-1 (embed)
267          NOTE: this only affects versions >= 0.37          NOTE: this only affects versions >= 0.37
268          - glib <unfixed> (embed)          - glib2.0 2.15.2-1 (embed)
         NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic  
269          - apache2 2.0.53-4 (embed)          - apache2 2.0.53-4 (embed)
270          - exim4 4.10-0.srh20.12 (embed)          - exim4 4.10-0.srh20.12 (embed)
271          - yacas <unfixed> (embed)          - yacas <unfixed> (embed)
272          NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway          NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
273          - gtamsanalyzer.app 0.42-5 (embed)          - gtamsanalyzer.app 0.42-5 (embed)
274            - tin 980117-1 (embed)
275            - kazehakase 0.5.2-1
276            - webkit 1.0.1-1 (embed)
277            - qt4-x11 <unfixed> (embed)
278            NOTE: embedded via webkit copy
279            - erlang <unfixed> (embed)
280            - ssed <unfixed> (embed)
281            - ircd-hybrid <unfixed> (static)
282            - emboss <unfixd>
283            - cherokee <unfixed> (embed)
284            - oftc-hybrid 1.6.9.dfsg-1 (embed)
285            - ratbox-services <unfixed> (embed)
286            - squeak-vm <unfixed> (embed)
287            - tinymux <unfixed> (embed)
288    
289  tiff  tiff
290          - wxpythongtk <unfixed> (embed)          - wxwindows2.4 2.2.1 (embed)
291          TODO: check, which debian pkg this is in          - gamera 3.2.3-1 (embed)
292            - freeimage <unfixed> (embed)
293            - libtk-img <unfixed> (embed)
294            NOTE: there are two copies, one under tiff/ other under libtiff/
295            - gdal <unfixed>
296    
297  uudeview  uudeview
298          - libconvert-uulib-perl <unfixed> (embed)          - libconvert-uulib-perl <unfixed> (embed)
299            - pan <unfixed> (embed)
300    
301  sqlite (not affected by security vulnerabilities so far)  sqlite (not affected by security vulnerabilities so far)
302          - amarok <unfixed> (embed)          - amarok <unfixed> (embed)
303          - monotone <unfixed> (embed)          - monotone 0.43-1 (embed)
304          - iceweasel <unfixed> (embed)          - iceweasel <unfixed> (embed)
305            - heimdal <unfixed> (embed; bug #559616)
306    
307  util-linux/mount  util-linux/mount
308          - loop-aes-utils <unfixed> (embed)          - loop-aes-utils <unfixed> (embed)
309          NOTE: contains code from util-linux' mount in the mount-aes-udeb          NOTE: contains code from util-linux' mount in the mount-aes-udeb
310    
 webmin  
         - usermin <unknown> (embed)  
         [sarge] - usermin <unfixed> (embed)  
   
311  sylpheed  sylpheed
312          - sylpheed-claws <unfixed> (fork)          - sylpheed-claws <unfixed> (fork)
313    
# Line 184  phpldapadmin Line 322  phpldapadmin
322  chmlib  chmlib
323          - kchmviewer <unknown> (embed)          - kchmviewer <unknown> (embed)
324    
325  libavcodec/libavformat (source: ffmpeg)  ffmpeg (libavcodec/libavformat)
326          - mplayer <unfixed> (embed; bug #395252)          - mplayer 1.0~rc2-14 (embed; bug #395252)
327          - xvidcap <unfixed> (embed)          - kino 1.0.0-1
328          - kino <unfixed> (static)          - vlc <not-affected> (Links dynamically since initial release)
329          - vlc <unfixed> (static)          - smilutils 0.3.0-10
330          - smilutils <unfixed> (static)          NOTE: smilutils likely fixed earlier, marking Etch's version as fixed
331          - motion <unfixed> (static)          - motion 3.1.19-1
332          - gst-ffmpeg <unfixed> (embed)          - gstreamer0.10-ffmpeg 0.10.3-2
333          - gstreamer0.10-ffmpeg <unfixed> (embed)          - xmovie <removed> (static)
         - xmovie <unfixed>  
334          TODO: gimp-gap (potentially using ffmpeg code as well)          TODO: gimp-gap (potentially using ffmpeg code as well)
335            - avifile 1:0.7.48~20090503.ds-1 (embed; bug #538750)
336            - audacity 1.3.7-2 (embed; bug #512278)
337            - chromium-browser <unfixed> (fork)
338    
339    faad2
340            - mplayer 1.0~rc2-20 (embed)
341            - avifile <unfixed> (embed; bug #538750)
342            - ffmpeg-debian <removed> (embed)
343    
344  mad MPEG decoding lib  libmad (MPEG decoding lib)
         - mad <unfixed> (embed)  
345          - xine-lib <unfixed> (embed)          - xine-lib <unfixed> (embed)
346            - avifile 1:0.7.48~20090503.ds-1 (embed) [./plugins/libmad/*]
347            TODO: check ocaml-mad, madplay, pymad, xmms-mad, xmms2
348    
349  libdts  libdts
350          - xine-lib <unfixed> (embed)          - xine-lib <unfixed> (embed)
# Line 210  liba52 Line 356  liba52
356          - a52dec <unfixed> (embed)          - a52dec <unfixed> (embed)
357          - xine-lib <unfixed> (embed)          - xine-lib <unfixed> (embed)
358    
359  libmpeg2  mpeg2dec (libmpeg2)
         - mpeg2dec <unfixed> (embed)  
360          - xine-lib <unfixed> (embed)          - xine-lib <unfixed> (embed)
361    
362  curl  libmpeg3
363          - wget <unfixed> (embed)          - squeak-vm <unfixed> (embed)
364          NOTE: code for NTLM authentication  
365    libntlm
366            - wget <unfixed> (fork; bug #550436)
367            - curl <unfixed> (fork; bug #550437)
368            - cntlm <unfixed> (fork; bug #550438)
369    
370  uw-imap  uw-imap
371          - pine <unfixed> (embed)          - pine <unfixed> (embed)
# Line 225  uw-imap Line 374  uw-imap
374  imagemagick  imagemagick
375          - graphicsmagick <unfixed> (fork)          - graphicsmagick <unfixed> (fork)
376    
377    python-urlgrabber
378            - mercurial <unfixed> (embed; bug #531062)
379            - w3af <unfixed> (embed; bug #555372)
380            [experimental] - harvestman <unfixed> (embed; bug #555373)
381    
382    beautifulsoup
383            - python-mechanize <unfixed> (embed; bug #555349)
384            - zope2.11 <removed> (embed; bug #555350)
385            - twill <unknown> (embed)
386    
387  halibut  halibut
388          - nsis <unfixed> (embed)          - nsis <unfixed> (fork)
389    
390  libghttp  libghttp
391          - hotway <unfixed> (embed)          - hotway <unfixed> (embed)
392    
393  libsndfile  libsndfile
394          - ardour <unfixed> (embed)          - ardour 1:2.7.1-1 (embed)
395    
396  glibmm2.4  glibmm2.4
397          - ardour <unfixed> (embed)          - ardour 1:2.7.1-1 (embed)
398    
399  libgnomecanvasmm2.6  libgnomecanvasmm2.6
400          - ardour <unfixed> (embed)          - ardour 1:2.7.1-1 (embed)
401    
402  libsigc++-2.0  libsigc++-2.0
403          - ardour <unfixed> (embed)          - ardour 1:2.7.1-1 (embed)
404    
405  soundtouch  soundtouch
406          - ardour <unfixed> (embed)          - ardour 1:2.7.1-1 (embed)
407    
408  libmms  libmms
409          - xine-lib <unfixed> (embed)          - xine-lib <unfixed> (embed)
410          - mimms <unfixed> (embed)          - mimms <unfixed> (embed)
411    
412  fckeditor  fckeditor
413          - knowledgeroot <unfixed> (embed)          - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
414          - moin <unfixed> (embed; bug #452599)          - moin 1.8.2-2 (embed; bug #452599)
415          - karrigell <unfixed> (embed; bug #452598)          - karrigell <removed> (embed; bug #452598)
416          - gforge-plugins-extra 4.6.99+svn6225-1 (embed)          - gforge 4.6.99+svn6225-1 (embed)
417            - request-tracker3.8 <unfixed> (embed)
418            - otrs2 <unfixed> (embed)
419    
420  ipatlas (not packaged in Debian)  ipatlas (not packaged in Debian)
421          - moodle <unfixed> (embed)          - moodle <unfixed> (embed; bug #507185)
422    
423  libphp-phpmailer  libphp-phpmailer
424          - moodle <unfixed> (embed)          - moodle <unfixed> (embed; bug #507185)
425            - mahara <unfixed> (embed)
426            - symfony <unfixed> (embed; bug #566778)
427            [etch] - phpgroupware <unfixed> (embed)
428            NOTE: phpgroupware-felamimail is only in etch
429            - egroupware <unfixed> (embed; bug #504283)
430            - glpi <unfixed>
431    
432  htmlArea (not packaged in Debian)  htmlArea (not packaged in Debian)
433          - moodle <unfixed> (embed)          - moodle <unfixed> (embed)
434    
435  bennu (not packaged in Debian)  giflib
436          - moodle <unfixed> (embed)          - wine <unfixed> (embed; bug #466181)
437    
438  smarty:  bennu (not packaged in Debian, http://bennu.sourceforge.net)
439          - moodle <unfixed> (embed)          - moodle <unfixed> (embed)
440    
441    smarty
442            - moodle 1.8.2-2 (embed; bug #471158)
443            - gallery2 2.2.5-2 (embed; bug #471160)
444            - mahara 0.9.2-2 (embed; bug #471201)
445            - gosa 2.4beta1-1 (embed; bug #471200)
446    
447  TinyMCE  TinyMCE
448          - wordpress <unfixed> (embed)          - wordpress 2.5.1-3 (embed; bug #478257)
449          - moodle <unfixed> (embed)          - moodle <unfixed> (embed; bug #507185)
450          - knowledgeroot <unfixed> (embed)          - knowledgeroot <unfixed> (embed)
451          - joomla <itp> (bug #326398)          - joomla <itp> (bug #326398)
452            - mahara 1.2.6-1 (embed; #597752)
453    
454  scintilla  scintilla (upstream provides static lib, rejected shared lib http://sf.net/support/tracker.php?aid=2488121)
455          - scite <unfixed> (embed)          - scite <unfixed> (embed)
456          - qscintilla <unfixed> (embed)          - qscintilla <unfixed> (embed)
457          - qscintilla2 <unfixed> (embed)          - qscintilla2 <unfixed> (embed)
458          - geany <unfixed> (embed)          - geany <unfixed> (fork)
459            - anjuta <unfixed> (embed)
460    
461  libphp-adodb  libphp-adodb
462          - moodle <unfixed> (embed)          - moodle <unfixed> (embed; bug #507185)
463          NOTE: also AdoDB-XML Schema          NOTE: also AdoDB-XML Schema
464          - gallery2 <unfixed> (embed)          - gallery2 <unfixed> (embed)
465          - phppgadmin <unfixed> (embed)          - phppgadmin <unfixed> (embed)
466          - egroupware <unfixed> (embed)          - egroupware <unfixed> (embed)
467          - phpwiki <unfixed> (embed)          - phpwiki <unfixed> (embed)
468            - torrentflux 2.0beta1-2 (embed)
469          - ipplan <unfixed> (embed)          - ipplan <unfixed> (embed)
470          - typo3 <unfixed> (embed)          - typo3-src <unfixed> (embed)
         - moodle <unfixed> (embed)  
471          - cacti <unknown> (embed)          - cacti <unknown> (embed)
472          [sarge] - cacti <unfixed> (embed)          [sarge] - cacti <unfixed> (embed)
473          NOTE: dependency exists, but internal version is used          NOTE: dependency exists, but internal version is used
474            - gforge 4.7~rc2-6 (embed)
475            - mahara <unfixed> (embed)
476    
477  gzip  gzip
478          - linux-kernel <unfixed> (embed)          - linux-2.6 <unfixed> (embed) [lib/inflate.c]
         NOTE: lib/inflate.c  
479          - klibc <unfixed> (embed)          - klibc <unfixed> (embed)
480          NOTE: based on linux-kernel gzip code          NOTE: based on linux-kernel gzip code
481          - busybox <unfixed> (embed)          - busybox <unfixed> (embed)
482            - pristine-tar <unfixed> (modified-embed)
483            NOTE: compression code only, not uncompression
484            - ncompress <unfixed> (old-version)
485    
486  neon  neon
487          - cadaver <unfixed> (embed; bug #188381)          - cadaver 0.22.3+debian-1 (embed; bug #188381)
488          - gnome-vfs2 <unfixed> (embed; bug #395874)          - gnome-vfs2 <unfixed> (embed; bug #395874)
489          - litmus <unfixed> (embed; #395875)          [etch] - litmus <unfixed> (embed; #395875)
490            - litmus <removed> (embed; #395875)
491          [sarge] - screem <unfixed> (embed)          [sarge] - screem <unfixed> (embed)
492          - sitecopy <unfixed> (embed; bug #395876)          - sitecopy 1:0.16.0-1 (embed; bug #395876)
493          [etch] - tla <unfixed> (embed; bug #395877)          [etch] - tla <unfixed> (embed; bug #395877)
494          [sarge] - tla <unfixed> (embed; bug #395877)          [sarge] - tla <unfixed> (embed; bug #395877)
495    
496  libmodplug  libmodplug
497          - gst-plugins-bad0.10 <unfixed> (embed)          - gst-plugins-bad0.10 0.10.10.2-1 (embed)
498    
499  libvncserver  libvncserver
500          - vino <unfixed> (embed)          - vino <unfixed> (embed)
# Line 322  libvncserver Line 502  libvncserver
502  putty  putty
503          - filezilla <unfixed> (embed)          - filezilla <unfixed> (embed)
504    
505  tinyxml (not packaged in Debian)  tinyxml (not packaged in Debian; itp bug #531968)
506          - filezilla <unfixed>          - filezilla <unfixed>
507            - crystalspace <unfixed> (embed)
508            - libwfut <unfixed> (embed)
509            - rarian <unfixed> (embed)
510            - bulletml <unfixed> (embed)
511            - pokerth <unfixed> (embed)
512            - qutecom <unfixed> (embed)
513            - sofa-framework <unfixed> (embed)
514            - yate <unfixed> (embed)
515            - antigrav <unfixed> (embed)
516            - balder2d <unfixed> (embed)
517            - cal3d <unfixed> (embed)
518            - criticalmass <unfixed> (embed)
519            - ember <unfixed> (embed)
520            - epiphany <unfixed> (embed)
521            - gambit <unfixed> (embed)
522            - noiz2sa <unfixed> (embed)
523            - ogre <unfixed> (embed)
524            - opencity <unfixed> (embed)
525            - openmovieeditor <unfixed> (embed)
526            - pouetchess <unfixed> (embed)
527            - tecnoballz <unfixed> (embed)
528            - trigger-rally <unfixed> (embed)
529            - xmoto <unfixed> (embed)
530            - mapnik <unknown> (embed)
531            NOTE: uses a different XML parser by default
532            - rrootage 0.23a-6 <embed>
533            NOTE: links to libbulltetml
534            - boson <unknown> (embed)
535            NOTE: the embedded code is unused
536    
537  gv  gv
538          - evince <unfixed> (embed)          - evince <unfixed> (embed)
539          NOTE: ps/ tree from gv 3.5.8          NOTE: ps/ tree from gv 3.5.8
540          - evince-gtk <unfixed> (embed)          NOTE: evince-gtk is affected (a component of evince source package)
         NOTE: not packaged in Debian  
541    
542  libXbae  libXbae
543          [etch] - libpawlib2-lesstif <unfixed> (embed)          - paw <unfixed> (embed)
544          NOTE: from Cernlib  
545    libgtkhtml
546            - claws-mail-extra-plugins <unfixed> (fork)
547    
548  libXaw  libXaw
549          [etch] - libpawlib2-lesstif          - paw <unfixed> (embed)
         NOTE: from Cernlib  
550          NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty          NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
551    
552  libgd2  libgd2
553          - graphviz <unfixed> (embed)          - graphviz <unfixed> (embed)
554          NOTE: lib/gd seems to be 2.0.33          NOTE: lib/gd seems to be 2.0.33
555            - wml 2.0.11ds2-1 (embed)
556            - libwmf <unfixed> (embed)
557            NOTE: derived from gd 1.6.3
558            - texlive-bin 2009-1 (embed)
559    
560  rar  rar
561          - unrar-nonfree <unfixed> (embed)          - unrar-nonfree <unfixed> (embed)
# Line 356  mplayer (DirectMedia Object loader) Line 569  mplayer (DirectMedia Object loader)
569          NOTE: src/libw32dll/          NOTE: src/libw32dll/
570          - vlc <unfixed> (embed)          - vlc <unfixed> (embed)
571          NOTE: modules/codec/dmo/          NOTE: modules/codec/dmo/
572            - mplayer 1.0~rc2-20 (embed)
573    
574  libwpd (WordPerfect converter)  libwpd (WordPerfect converter)
575          - openoffice.org <unfixed> (embed)          - openoffice.org <unfixed> (embed)
# Line 364  fsplib (http://sourceforge.net/projects/ Line 578  fsplib (http://sourceforge.net/projects/
578          - gftp <unfixed> (embed)          - gftp <unfixed> (embed)
579          NOTE: lib/fsplib version 0.3          NOTE: lib/fsplib version 0.3
580    
581    sprng
582            - tree-puzzle <unfixed> (embed)
583    
584  librpcsecgss  librpcsecgss
585          - krb5 <unfixed> (embed)          - krb5 <unfixed> (embed)
586    
587  jasper  jasper
588          - ghostscript <unfixed> (embed)          - ghostscript 8.64~dfsg-2 (embed)
         - gs-gpl <unfixed> (embed)  
589    
590    libiris
591            - psi <unfixed> (embed)
592            - kdenetwork <unfixed> (embed)
593            NOTE: kopete embeds libiris but links dynamically to libidn
594            - kdegames <unfixed> (embed)
595            NOTE: ksirk/kde4
596    
597  libidn  libidn
598          - monotone <unfixed> (embed)          - monotone 0.43-1 (embed)
599            - psi <unfixed> (embed)
600  liblua          NOTE: psi embeds libiris which embeds libidn
601          - monotone <unfixed> (embed)          - kdegames <unfixed> (embed)
602            NOTE: kdegames/kde4 embeds libiris which embeds libidn
603    
604    lua5.1
605            - monotone 0.43-1 (embed)
606            - nmap 5.00-1 (embed; bug #527997)
607            [lenny] - nmap <unfixed> (embed; bug #527997)
608            - ocropus <unfixed> (embed)
609            - enigma <unfixed> (embed)
610            NOTE: requires lua built with C++
611            - freeciv <unfixed> (embed)
612            - spring <unfixed> (embed)
613    
614  libbotan  libbotan
615          - montone <unfixed> (embed)          - monotone 0.43-1 (embed)
616    
617  NetXX  NetXX
618          - monotone <unfixed> (embed)          - monotone 0.43-1 (embed)
619    
620  libgc  libgc
621          - mono <unfixed> (embed)          - mono <unfixed> (embed)
622    
623  lzma  lzma
624          - p7zip <unfixed> (embed)          - p7zip <unfixed> (embed)
625            - xz-utils <unfixed> (fork)
626    
627  lzo  lzo
628          - grub2 <unfixed> (embed)          - grub2 <unfixed> (embed)
629    
630    yassl
631            - mysql-dfsg-5.0 <unfixed> (embed)
632            - mysql-5.1 <unfixed> (embed)
633    
634  pax code  pax code
635          - tar <unfixed> (embed)          - tar <unfixed> (embed)
636          - cpio <unfixed> (embed)          - cpio <unfixed> (embed)
# Line 399  pax code Line 638  pax code
638  t1lib  t1lib
639          - tetex-bin 2.0.2-1 (embed)          - tetex-bin 2.0.2-1 (embed)
640          - texlive-bin <unknown> (embed)          - texlive-bin <unknown> (embed)
641    
642    guichan
643            - boswars <unfixed> (embed)
644            NOTE: maintainer notified us, working on it
645    
646    tolua
647            - boswars <unfixed> (embed)
648            NOTE: maintainer notified us, working on it
649            NOTE: actually tolua++
650            - ocropus <unfixed> (embed)
651            NOTE: actually tolua++
652            - freeciv <unfixed> (embed)
653            NOTE: actually tolua++
654            - enigma <unfixed> (embed)
655    
656    asio-dev
657            - luxrender <removed> (embed)
658    
659    xine-lib
660            - vlc <unfixed> (embed)
661            NOTE: only parts included in modules/access/rtsp
662    
663    netpbm
664            - tcl8.3 <unfixed> (embed)
665            - tcl8.4 <unfixed> (embed)
666            - tcl8.5 <unfixed> (embed)
667            NOTE: generic/tkImgGIF.c
668    
669    tk8.5
670            - tk8.0 <removed> (old-version)
671            - tk8.3 <unfixed> (old-version)
672            - tk8.4 <unfixed> (old-version)
673            - perl-tk <unfixable> (fork)
674    
675    samba
676            - mc 2:4.6.2~git20080311-1 (embed)
677            NOTE: maintainer is aware of this, currently searching a solution
678    
679    plib1.8.4c2
680            - boson <unfixed> (fork)
681            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
682    
683    fribidi
684            - quesoglc 0.7.2-2 (embed)
685    
686    glew
687            - quesoglc <unfixed> (embed; bug #489341)
688            NOTE: waiting on GLEW_MX version of glew (see bug #474488)
689            - trigger 0.5.2.1-2 (embed)
690            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
691            - trigger-rally 0.5.2.1-2 (embed)
692            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
693            - chromium-browser 5.0.375.70~r48679-2
694    
695    minorGems (pabs contacted upstream about shared lib, he considers minorGems an 'ever-evolving collection of reusable code fragments' for his own use)
696            - transcend <unfixed> (embed)
697            - cultivation <unfixed> (embed)
698            - passage <unfixed> (embed)
699            - gravitation <unfixed> (embed)
700    
701    tar
702            - libarchive <unfixed> (embed)
703            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
704    
705    cpio
706            - libarchive <unfixed> (embed)
707            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
708    
709    kde4libs
710            - kdelibs <unfixable> (old-version)
711    
712    webkit
713            - qt4-x11 <unfixed> (embed; bug #479851)
714            [etch] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
715            - kde4libs <unfixable> (fork)
716            NOTE: kde4lib's khtml and webkit were forked from khtml (this tracking, which seems
717            NOTE: reversed genesis-wise, is used because of so much other stuff in kde4libs)
718            - chromium-browser <unfixed> (fork)
719    
720    ftgl
721            - blender 2.46+dfsg-1 (embed)
722    
723    wv
724            - abiword <unfixed>
725    
726    qemu
727            - kvm <removed> (embed; bug #543159)
728            - qemu-kvm <unfixed> (embed; bug #560853)
729            NOTE: kvm superceded by qemu-kvm, which is just user interface (no modules)
730            - xen-3 3.4.2-2 (embed; bug #560856)
731            - xen-unstable <unfixed> (embed; bug #560856)
732    
733    vgabios
734            - kvm <removed> (embed; bug #489442)
735            - qemu-kvm <unfixed> (embed)
736    
737    bochs
738            - kvm <removed> (embed; bug #489442)
739            - qemu-kvm <unfixed> (embed)
740    
741    speex
742            - vorbis-tools <unfixed> (embed)
743            NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
744            - gst-plugins-good0.10 <unfixed> (embed)
745            - xine-lib <unfixed> (embed)
746            - libfishsound <unfixed> (embed)
747            - libannodex <removed> (embed)
748            - vlc <unfixed> (embed)
749            - xmms-speex <unfixed> (embed)
750            - libsdl-sound1.2 <unfixed> (embed)
751            - sweep <unfixed> (embed)
752    
753    libreadline
754            - magic <itp> (old-version)
755    
756    opcode
757            - ode <unfixed> (embed)
758            NOTE: opcode is not a package in debian, it is just embedded
759            NOTE: http://www.codercorner.com/Opcode.htm
760    
761    gimpact
762            - ode <unfixed> (embed)
763            NOTE: gimpact is not a package in debian, it is just embedded
764            NOTE: http://gimpact.sf.net
765    
766    mochikit
767            - mahara <unfixed> (embed)
768            NOTE: they require extra patches, still unmerged upstream
769            - ntop <unfixed> (embed)
770            - coherence 0.6.2-1 (embed)
771            - paste <unfixed> (embed)
772            - turbogears <unfixed> (embed)
773            - plone3 <removed> (embed)
774            - xulrunner <unfixed> (embed)
775            - libjifty-plugin-chart-perl <unfixed> (embed)
776            - sabnzbdplus <unfixed> (embed)
777            - tgmochikit <unfixed> (embed)
778    
779    prototypejs
780            - netbeans-ide 6.0.1+dfsg-2 (embed)
781            - auth2db 0.2.5-2+dfsg-1 (embed; bug #555218)
782            - webcit <unfixed> (embed; bug #555219)
783            - asterisk 1:1.6.2.0~rc3-1 (embed)
784            - libjson-ruby 1.1.4-1 (embed; bug #555224)
785            - lucene2 2.9.1+ds1-2 (embed; bug #555226)
786            - horde3 <unfixed> (embed)
787            - knowledgeroot 0.9.8.5-4 (embed; bug #555230)
788            - mediatomb 0.12.0~svn2018-5 (embed; bug #555233)
789            - mt-daapd 0.9~r1696.dfsg-6lenny2 (embed)
790            - ebug-http <unfixed> (embed; bug #555236)
791            - libaws 2.7-1 (embed; bug #555222)
792            - phpgedview <removed> (embed)
793            - poker-network 1.7.6-1 (embed; bug #555238)
794            - rails 2.1.0-6 (embed)
795            - wordpress 2.5.0-2 (embed; bug #555243)
796            - zope <not-affected> (the prototypejs embed is not in any of the obvious zope packages, e.g. zope2.9, zope2.10, zope2.11, and zope3)
797            TODO: search through all of the other zope packages
798            - ampache 3.4.1-2 (embed)
799            - exaile 0.2.14+debian-2.1 (embed; bug #555245)
800            - hobix 0.5~svn20070319-4 (embed; bug #555247)
801            - zabbix 1.6.6-4 (embed; bug #555250)
802            - chora2 2.1.1+debian0-1 (embed; bug #555253)
803            - gollem 1.1.1+debian0-1 (embed; bug # 555254)
804            - jscropperui 1.2.1-1 (embed; bug #555257)
805            - scriptaculous <not-affected> (uses system prototype.js since initial upload; bug #555260)
806            - ingo1 1.2.3+debian0-1 (embed; bug #555261)
807            - kronolith2 2.3.3+debian0-1 (embed; bug #555262)
808            - activeldap 1.2.1-1 (embed)
809            - libv8 <not-affected> (contains a google-specific implementation of prototype.js)
810            - mantis 1.1.2+dfsg-1 (embed; bug #555265)
811            - otrs2 2.3.4-6 (embed; bug #555267)
812            - webcalendar 1.2~b1-2 (embed; bug #555269)
813            - redmine 0.9.0~svn2907-1 (embed; bug #555270)
814            - jifty 0.90519-1 (embed; bug #555271)
815            - jquery 1.4-1 (embed; bug #555272)
816            - passenger 2.2.5debian1-1 (embed; bug #555273)
817            - plone3 <removed> (embed; bug #555275)
818            - wesnoth <not-affected> (prototype.js not included in any of the binary packages; bug #555277)
819            - libhtml-prototype-perl 1.48-3 (embed; bug #538920)
820            - xulrunner <unfixed> (embed)
821            NOTE: included in iceweasel/xulrunner unit tests directory, so may not be security-relevant
822            - jclicmoodle <unfixed> (embed)
823            - git-cola <unfixed> (embed)
824    
825    gdb
826            - insight <unfixed> (embed)
827    
828    e2fsprogs
829            - ldiskfsprogs <unfixable> (fork)
830    
831    quazip (not packaged in Debian)
832            - qcake <unfixed> (embed)
833            NOTE: starting with upstream version 0.6.4
834    
835    exo
836            - pcmanfm <unfixed> (embed; bug #499677)
837            NOTE: slightly modified source code
838    
839    java
840            - openjdk-6 <unfixed>
841            - sun-java5 <unfixed>
842            - sun-java6 <unfixed>
843    
844    libphp-snoopy
845            - ampache 3.4.1-2 (embed; bug #504169)
846            - gforge 4.6.99+svn6094-2 (embed)
847            - mahara 1.0.5-2 (embed; bug #504170)
848            - pixelpost 1.7.1-5 (embed; bug #504171)
849            - mediamate 0.9.3.6-5 (embed; bug #504172)
850            - opendb <removed> (embed; bug #504173)
851            [etch] - opendb <unfixed> (embed; bug #504173)
852            - wordpress 2.5.1-9 (embed; bug #443948)
853            - moodle <unfixed> (embed; bug #507185)
854            [etch] - phpgroupware <unfixed> (embed)
855            NOTE: phpgroupware-felamimail
856            - magpierss 0.72-3 (embed; bug #431089)
857    
858    jquery
859            - zekr <unfixed> (embed)
860            - wordpress <unknown> (embed)
861            - yocto-reader <unfixed> (embed)
862            - textpattern <unfixed> (embed)
863            - genshi 0.5.1-1 (embed)
864            NOTE: compressed file under examples/ dir
865            - prewikka <unfixed> (embed)
866            - libramaze-ruby <unfixed> (embed)
867            - drupal6 <unfixed> (embed)
868            - b2evolution <unfixed> (embed)
869            - wesnoth <unfixed> (embed)
870    
871    tablesorter (jquery plugin, not packaged yet)
872            - wesnoth <unfixed> (embed)
873    
874    kses
875            - wordpress <unfixed> (embed; bug #504242)
876            NOTE: their copy has all methods renamed to wp_<foo>
877            NOTE: kses isn't in Debian, RFP: #504240
878            - moodle <unfixed> (embed; bug #507185)
879            - egroupware <unfixed> (embed)
880    
881    magpierss
882            - wordpress <unfixed> (embed; bug #504242)
883            - moodle <unfixed>
884    
885    php-gettext
886            - wordpress 2.8.4-1 (embed; bug #504242)
887            - docbookwiki <unfixed> (embed)
888            - knowledgeroot 0.9.9.5-1
889            NOTE: non-free
890    
891    libphp-ixr (name may change, it is the Incutio XML-RPC)
892            - wordpress <unfixed> (embed; bug #504242)
893            NOTE: libphp-ixr isn't in Debian, RFP: #504236
894            - dokuwiki <unfixed> (embed)
895            - textpattern <unfixed> (embed)
896    
897    libphp-cas
898            - glpi <unfixed> (embed)
899            - moodle <unfixed> (embed; bug #505984)
900    
901    scriptaculous (prototype.js is among the embeds in the following)
902            - glpi <unfixed> (embed)
903            - libaws <unfixed> (embed; bug #555222)
904            - op-panel <unfixed> (embed)
905            - symfony <unfixed> (embed)
906            NOTE: maintainer says there are extra incompatible changes required
907            - pixelpost 1.7.1-6 (embed)
908            - webhelpers <unfixed> (embed)
909            - qwik <removed> (embed; bug #555241)
910            - smokeping <unfixed> (embed)
911            - turba2 <unfixed> (embed)
912            - typo3-src 4.2.3-1 (embed)
913            - request-tracker3.6 <unfixed> (embed)
914            - request-tracker3.8 <unfixed> (embed)
915            - rt-extension-emailcompletion <not-affected> (prototype.js not included in the binary package)
916            - wordpress 2.5.0-2 (embed)
917            - libhtml-prototype-perl 1.48-3 (embed)
918    
919    libmarkdown-php
920            - moodle <unfixed> (embed; bug #507185)
921            - pixelpost 1.7.1-6 (embed)
922    
923    php-openid
924            - wordpress-openid 3.3.2-1 (embed)
925    
926    geshi
927            - dokuwiki 0.0.20080505-3.1 (embed)
928            - pgfouine 1.0-1.1 (embed)
929            - websvn 2.1.0-1 (embed)
930    
931    webcalendar
932            - gforge 4.7~rc2-6 (embed; bug #504758)
933    
934    libical
935            - kdepim <unknown> (fork)
936            NOTE: fixed at some point during 4.0
937            - kdepimlibs 4.2.0-1 (fork)
938            - claws-mail-extra-plugins <unfixed> (fork)
939    
940    harfbuzz
941            - qt4-x11 <unfixed> (embed)
942            - pango1.0 <unfixed> (embed)
943            - fontmatrix <unfixed> (embed)
944    
945    libzip
946            - php5 <unfixable> (modified-embed)
947            - odt2txt <unfixed> (embed; bug #523808)
948    
949    json.php (not packaged; should be replaced with php's built-in functions)
950            - moodle <unfixed>
951            - yui <unfixed>
952            - gallery2 <unfixed>
953            - dokuwiki <unfixed>
954            - typo3-src <unfixed>
955    
956    php-fpdf
957            - tcpdf <itp> (fork)
958            - moodle <unfixed>
959            - phpwiki <unfixed>
960            - egroupware <unfixed>
961            - ldap-account-manager <unfixed> (fork)
962    
963    tcpdf (itp: #495985)
964            - moodle <unfixed>
965            - phpmyadmin <unfixed>
966    
967    typo3
968            - moodle <unfixed>
969    
970    spreadsheet_writeexcel (PHP port of libspreadsheet-writeexcel-perl; itp: #487557)
971            - moodle <unfixed>
972            - gosa <unfixed>
973    
974    php-ole (itp: #487558)
975            - moodle <unfixed>
976    
977    pieforms (http://www.catalyst.net.nz)
978            - mahara <unfixed>
979    
980    savant2 (http://phpsavant.com)
981            - egroupware <unfixed>
982    
983    rssparser (http://nwow.org)
984            - egroupware <unfixed>
985            - phpgroupware <unfixed>
986    
987    lcms
988            - openjdk-6 <unfixed> (fork)
989            - gimp 2.4.0~rc2-2
990    
991    libphp-phplayersmenu
992            - diogenes <unfixed>
993            - phpldapadmin <unfixed>
994    
995    libphp-pclzip
996            - docvert <unfixed>
997            - moodle <unfixed>
998            - egroupware <unfixed>
999    
1000    libphp-simplepie
1001            - dokuwiki <unfixed>
1002            - wordpress <unfixed>
1003    
1004    libphp-jpgraph
1005            - egroupware <unfixed>
1006    
1007    php-simpletest
1008            - moodle <unfixed>
1009    
1010    libpng
1011            - iceweasel <not-affected> (uses xulrunner)
1012            - icedove 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1, 2.0.0.19-1 (embed)
1013            - iceape 1.0.13~pre080614i-0etch1 (embed)
1014            - xulrunner 1.9.0.13-1 (embed)
1015            [lenny] - xulrunner 1.9.0.11-0lenny1
1016            [etch] - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
1017            - gamera 3.2.3-1 (embed)
1018            - freeimage <unfixed> (embed)
1019            - tuxonice-userui <unfixed> (static)
1020    
1021    irssi
1022            - silc-client <unfixed> (embed)
1023            NOTE: Seems to be a pre-0.8.12 version that is used in irssi-plugin-silc
1024    
1025    extc
1026            - mtasc <unfixed> (embed)
1027            - haxe <unfixed> (embed)
1028    
1029    swflib
1030            - mtasc <unfixed> (embed)
1031            - haxe <unfixed> (embed)
1032    
1033    libitext-java
1034            - bouncycastle 2.1.4-1 (embed)
1035    
1036    python-ply
1037            - pyke <unfixed> (embed; bug #555363)
1038            - pywbem 0.7.0-4 (embed; bug #555364)
1039            - sepolgen <unfixed> (embed; bug #555365)
1040            - zope-textindexng3 <unknown> (embed)
1041            - iceweasel <not-affected> (uses xulrunner)
1042            - xulrunner <unknown> (embed)
1043            - wireshark <not-affected> (python-ply modules are not installed into binary packages; see #554613)
1044    
1045    libdumbnet (libdnet upstream)
1046            - nmap <unfixed> (fork)
1047    
1048    gcc-4.4
1049            - gcc-mingw32 <unfixed> (embed)
1050    
1051    camlimages
1052            - advi <unfixed> (static; bug #550441)
1053    
1054    memcached
1055            - memcachedb <unfixed> (embed)
1056    
1057    yajl
1058            - argyll <unfixed> (embed; bug #544223)
1059            NOTE: reference, confirmed by build logs: http://lists.debian.org/debian-mentors/2009/08/msg00062.html
1060    
1061    nusoap
1062            - gforge 4.8.2-1 (embed)
1063            - ampache <unfixed> (embed)
1064            - poker-network <unfixed> (embed)
1065            - moodle <unfixed> (embed)
1066            NOTE: code is not used when running under php5 and soap is enabled
1067            - phpwiki <unfixed> (embed)
1068            - gallery2 <unfixed> (embed)
1069            - typo3-src <unfixed> (embed)
1070            - phpgacl 3.3.7-7 (embed)
1071            - mantis 1.1.8+dfsg-1 (embed)
1072    
1073    libept
1074            - adept <unfixed> (embed; bug #540649)
1075    
1076    libvorbis
1077            - iceweasel <not-affected> (uses xulrunner)
1078            - xulrunner <unfixed> (embed; bug #540959)
1079            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1080            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1081            - iceape <unfixed> (embed)
1082            [etch] - iceape <not-affected> (introduced in 2.0)
1083            [lenny] - iceape <not-affected> (introduced in 2.0)
1084    
1085    cairo
1086            - iceweasel <not-affected> (uses xulrunner)
1087            - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
1088    
1089    liboggz
1090            - iceweasel <not-affected> (uses xulrunner)
1091            - xulrunner <unfixed> (embed; bug #540959)
1092            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1093            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1094            - iceape <unfixed> (embed)
1095            [etch] - iceape <not-affected> (introduced in 2.0)
1096            [lenny] - iceape <not-affected> (introduced in 2.0)
1097    
1098    liboggplay
1099            - iceweasel <not-affected> (uses xulrunner)
1100            - xulrunner <unfixed> (embed; bug #540959)
1101            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1102            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1103            - iceape <unfixed> (embed)
1104            [etch] - iceape <not-affected> (introduced in 2.0)
1105            [lenny] - iceape <not-affected> (introduced in 2.0)
1106    
1107    php-net-dnsbl
1108            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1109    
1110    php-onyx-rss
1111            - serendipity <unfixed> (embed; bug #541740; wontfix: only one script, own package is overkill, appears not to be duplicated in Debian)
1112    
1113    php-text-wiki
1114            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1115    
1116    php-xml-rpc
1117            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1118    
1119    polarssl (does not have a shared library)
1120            - pdkim <itp> (embed; bug #543150)
1121            - xyssl <unfixed> (old-version)
1122    
1123    pidgin (libpurple)
1124            - gaim <removed> (old-version)
1125            - qutecom 2.2~rc3.hg396~dfsg1-6 (embed; bug #559785)
1126    
1127    icu
1128            - webkit 1.0.1-1 (embed; bug #547214)
1129            - texlive-bin <unfixed> (fork)
1130            NOTE: texlive upstream working with icu upstream to merge their changes
1131            - chromium-browser 5.0.375.29~r46008-3
1132    
1133    cyrus-imapd-2.2
1134            - kolab-cyrus-imapd <unfixed> (fork)
1135            - dovecot 1:1.2.1-1 (embed) [/dovecot-sieve/src/libsieve/*]
1136    
1137    python-cxx-dev
1138            - freecad 0.9.2646.3-1 (embed; bug #547936)
1139    
1140    zipios++
1141            - freecad 0.9.2646.3-1 (embed; bug #547941)
1142            - enigma 0.92.3-3 (embed)
1143            NOTE: likely fixed earlier, marking etch's version as fixed
1144    
1145    linux-2.6
1146            - kvm <removed> (embed; bug #549973) [./kernel/*]
1147            - linux-kbuild-2.6 <unfixed> (embed; bug #550379) [./kbuild/*]
1148            - kernel-source-2.6.8 <removed> (old-version)
1149            - kernel-source-2.4.27 <removed> (old-version)
1150            - kernel-source-2.4.24 <removed> (old-version)
1151            - kernel-source-2.2.25 <removed> (old-version)
1152            - kernel-source-2.2.20 <removed> (old-version)
1153    
1154    libfdt (not yet packaged separately for debian; http://www.jdl.com/software/)
1155            - kvm <removed> (embed) [./libfdt/*]
1156            - qemu-kvm <unfixed> (embed) [./libfdt/*]
1157    
1158    qweb (not packaged)
1159            - ajaxterm <unfixed>
1160    
1161    opensaml2
1162            - opensaml <removed> (old-version)
1163    
1164    shibboleth-sp2
1165            - shibboleth-sp <removed> (old-version)
1166    
1167    tuxonice-userui
1168            - suspend2-userui <removed> (old-version)
1169    
1170    expat
1171            - w3c-libwww <removed> (embed; bug #551941)
1172            [etch] - w3c-libwww <unfixed> (embed; bug #551941) [./modules/expat/*]
1173            - python-xml <unfixed> (embed; bug #551940) [./extensions/expat/*]
1174            - python2.5 <unfixable> (embed; bug #553403) [./Modules/expat/*]
1175            - python2.4 <unfixable> (embed; bug #553403)
1176            - python2.7 2.7-6 (embed)
1177            - python-4suite <unfixed> (embed; bug #516935)
1178            - wxwindows2.4 <removed> (embed)
1179            - wxwidgets2.6 2.6.3.2.2-4 (embed)
1180            - wxwidgets2.8 2.8.10.1-2 (embed)
1181            - celementtree 1.0.5-8 (embed)
1182            NOTE: Maybe that was fixed even earlier
1183            - audacity 1.3.2-1 (embed)
1184            - matanza <unfixed> (embed)
1185            - tdom 0.8.3~20080525-1 (embed)
1186            - udunits 2.1.8-4 (embed)
1187            - apr-util 1.2 (embed)
1188            - ayttm <unfxed> (embed; bug #561006)
1189            - cableswig <unfixed> (embed)
1190            - cadaver <unfixed> (embed)
1191            - cmake 2.6.0-6 (embed)
1192            - coin3 <unfixed> (embed)
1193            - gdcm 2.0.14-2 (embed)
1194            - ghostscript 8.71~dfsg-2 (embed)
1195            - grmonitor <removed> (embed)
1196            - iceape <unfixed> (embed)
1197            - insighttoolkit 3.16.0-1 (embed)
1198            NOTE: insighttoolkit might've been fixed earlier
1199            - libparagui1.1 1.0.2-1 (embed)
1200            - paraview 3.6.2-1 (embed)
1201            - poco 1.3.6p1-1 (embed)
1202            - simgear <unfixed> (embed)
1203            - sitecopy 1:0.16.0-1
1204            - smart <unfixed> (embed)
1205            NOTE: smart embeds celementree, and it includes expat
1206            - swish-e <not-affected> (Linked against libxml, which is used instead)
1207            - tla 1.3.5+dfsg-15 (embed)
1208            - vtk 4.1.20030227-1 (embed)
1209            - wbxml2 <not-affected> (expat code is only used on Mac OS X, see #560941)
1210            - xmlrpc-c <unfixed> (embed)
1211            - iceweasel <unfixed> (embed)
1212            - kompozer <unfixed> (embed)
1213            - vxl 1.13.0-2 (embed)
1214            - xulrunner <unfixed> (embed)
1215            - apache2 2.2 (embed)
1216            - texlive-bin <not-affected> (Embedded code not compiled in)
1217            - vnc4 <unfixed> (embed)
1218            - xotcl 1.6.6-1 (embed)
1219            - chromium-browser 5.0.375.29~r46008-3
1220    
1221    xerces-c
1222            - xerces-c2 <unfixed> (old-version)
1223            - xerces27 <removed> (old-version)
1224    
1225    md5 (RSA's version; not the gnu version provided by coreutils)
1226            - w3c-libwww <removed> (embed; bug #551942)
1227            [etch] - w3c-libwww <unfixed> (embed; bug #551942) [./modules/md5/*]
1228    
1229    libparagui1.1
1230            - asc <unfixable> (fork)
1231    
1232    enet
1233            - sauerbraten <unfixed> (embed; #497194)
1234    
1235    eglibc
1236            - glibc <removed> (old-version)
1237            - mksh <unfixable> (static)
1238              NOTE: /bin/mksh-static only, and only on some arches (others use dietlibc)
1239    
1240    galib
1241            - gamera 3.2.3-1 (embed)
1242    
1243    configobj
1244            - bzr 2.1.0~rc2-1 (embed; bug #555336)
1245            - elisa <unfixed> (embed; bug #555337)
1246            - gaupol <unfixed> (embed; bug #555338)
1247            - ipython <unfixed> (embed; bug #555339)
1248            - pida <unfixed> (embed; bug #555340)
1249            - psychopy <unfixed> (embed; bug #555341)
1250            - rest2web <unfixed> (embed; bug #555342)
1251            - auth2db <unknown> (embed)
1252            - dynagen <unknown> (embed)
1253            - iceweasel <unknown> (embed)
1254            - sabnzbdplus <unknown> (embed)
1255            - xulrunner <unknown> (embed)
1256            - nipy <not-affected> (part of an example [/examples/neurospin/neurospy/configobj.py], which is not installed into binary packages)
1257    
1258    python-clientform
1259            - bibus <unfixed> (embed; bug #555332)
1260            - zope2.10 <unfixed> (embed; bug #555333)
1261            - zope2.11 <removed> (embed; bug #555334)
1262            - python-mechanize <unknown> (embed)
1263            - twill <unknown> (embed)
1264    
1265    python-mechanize
1266            - zope2.10 <unfixed> (embed; bug #555337)
1267            - zope2.11 <removed> (embed; bug #555338)
1268            - twill <unknown> (embed; bug #555339)
1269    
1270    pexpect
1271            - duplicity 0.6.06-1 (embed; bug #555361)
1272            - hplip <unfixed> (embed; bug #555362)
1273            - smart <unfixed> (embed; bug #555363)
1274    
1275    pyparsing
1276            - bauble <unfixed> (embed; bug #555366)
1277            - boa-constructor 0.6.1-8 (embed; bug #555367)
1278            - calibre <unfixed> (embed; bug #555368)
1279            - matplotlib <unfixed> (embed; bug #531024)
1280            - zhpy 1.7.3.1-1 (embed; bug #555370)
1281            - polybori <unknown> (embed)
1282            - python-whoosh <unknown> (embed)
1283            - twill <unknown> (embed)
1284            - zope-textindexng3 <unknown> (embed)
1285    
1286    python-pysqlite2
1287            - python2.4 <unfixed> (embed; bug #553403)
1288            - python2.5 <unfixed> (embed; bug #553403)
1289    
1290    celementtree
1291            - python2.5 <unfixed> (embed)
1292            - smart <unfixed> (embed)
1293    
1294    elementtree
1295            - python2.5 <unfixed> (embed)
1296            - python2.6 <unfixed> (embed)
1297            - bzr 2.1.0~rc2-1 (embed; bug #555343)
1298            - gedit 2.28.2-1 (embed; bug #555344)
1299            - smart <unfixed> (embed)
1300            - solfege <unfixed> (embed; bug #555345)
1301            - w3af <unfixed> (embed; bug #555346)
1302            - python-qt4 <unknown> (embed)
1303            - sphinx <unknown> (embed)
1304            - python-nltk <itp> (embed)
1305    
1306    python2.5
1307            - python2.4 <unfixed> (old-version)
1308            - jython <unfixed> (embed)
1309            NOTE: embeds many stdlib modules
1310            - python-django <unfixed> (embed; bug #555419)
1311            NOTE: embeds stdlib modules: doctest, decimal
1312            - gamera 3.2.3-1 (embed)
1313            NOTE: embeds stdlib modules: ConfigParser, optparse, sets, textwrap
1314            - boa-constructor <unfixed> (embed; bug #555426)
1315            NOTE: embeds stdlib modules: ConfigParser, tarfile, zipfile, xmlrpclib
1316            - nicotine <unfixed> (embed; bug #555427)
1317            NOTE: embeds stdlib modules: ConfigParser
1318            - museek+ <unfixed> (embed; bug #555428)
1319            NOTE: embeds stdlib modules: ConfigParser
1320            - vegastrike-data <removed> (embed)
1321            NOTE: embeds many stdlib modules
1322            - codespeak-lib 1.1.1-1 (embed; bug #555420)
1323            NOTE: embeds stdlib modules: doctest, optparse, subprocess, textwrap
1324            - config-manager <unfixed> (embed; bug #555423)
1325            NOTE: embeds stdlib modules: optparse
1326            - jhbuild 2.28.0-1 (embed; bug #555421)
1327            NOTE: embeds stdlib modules: optparse, subprocess
1328            - smart <unfixed> (embed; bug #555432)
1329            NOTE: embeds stdlib modules: optparse
1330            - pyprotocols 1.0a.svn20070625-5 (embed; bug #555433)
1331            NOTE: embeds stdlib modules: doctest
1332            - ruledispatch 0.5a.svn20080510-4 (embed; bug #555434)
1333            NOTE: embeds stdlib modules: doctest
1334            - distribute <unfixed> (embed)
1335            NOTE: embeds stdlib modules: doctest
1336            - python-setuptools <unfixed> (embed; bug #555435)
1337            NOTE: embeds stdlib modules: doctest
1338            - zope.testing <unfixed> (embed; bug #555436)
1339            NOTE: embeds stdlib modules: doctest
1340            - translate-toolkit <unfixed> (embed; bug #555422)
1341            NOTE: embeds stdlib modules: textwrap, contextlib
1342            - libtpclient-py <unfixed> (embed; bug #555424)
1343            NOTE: embeds stdlib modules: subprocess
1344            - grass <unfixed> (embed; bug #555425)
1345            NOTE: embeds stdlib modules: subprocess
1346            - coherence <unfixed> (embed; bug #555429)
1347            NOTE: embeds stdlib modules: uuid
1348            - python-django-extensions 0.4.2pre+git200911182050-1 (embed; bug #555430)
1349            NOTE: embeds stdlib modules: uuid
1350            - setroubleshoot <removed> (embed; bug #555431)
1351            NOTE: embeds stdlib modules: uuid
1352            - linkchecker <unfixed> (embed; bug #555414)
1353            NOTE: embeds msgfmt.py script
1354            - imdbpy <unfixed> (embed)
1355            NOTE: embeds msgfmt.py script
1356            - kiwi <unfixed> (embed)
1357            NOTE: embeds msgfmt.py script
1358            - moin <unfixed> (embed)
1359            NOTE: embeds msgfmt.py script, stdlib modules: cgitb, difflib, tarfile
1360            - plone3 <removed> (embed)
1361            NOTE: embeds msgfmt.py script
1362            - roundup <unfixed> (embed)
1363            NOTE: embeds msgfmt.py script, stdlib modules: cgitb
1364            - rednotebook <unfixed> (embed; bug #555415)
1365            NOTE: embeds msgfmt.py script
1366            - turbogears <unfixed> (embed)
1367            NOTE: embeds msgfmt.py script
1368            - elisa <unfixed> (embed)
1369            NOTE: embeds msgfmt.py script, stdlib modules: uuid
1370            - calibre <unfixed> (embed)
1371            NOTE: embeds msgfmt.py script, stdlib modules: zipfile
1372            - mailman 1:2.1.13-1 (embed; #555416)
1373            NOTE: embeds msgfmt.py script
1374            - python-docutils <unknown> (embed)
1375            NOTE: embeds stdlib modules: optparse, textwrap
1376            - python-imaging <unknown> (embed)
1377            NOTE: embeds stdlib modules: doctest
1378            - python-mechanize <unknown> (embed)
1379            NOTE: embeds stdlib modules: doctest
1380            - twill <unknown> (embed)
1381            NOTE: embeds stdlib modules: subprocess
1382            - zeroc-ice <unknown> (embed)
1383            NOTE: embeds stdlib modules: subprocess
1384            - wxwidgets2.8 <unknown> (embed)
1385            NOTE: embeds stdlib modules: subprocess
1386            - cycle <unknown> (embed)
1387            NOTE: embeds msgfmt.py script
1388            - deluge <unknown> (embed)
1389            NOTE: embeds msgfmt.py script
1390            - opendict <unknown> (embed)
1391            NOTE: embeds msgfmt.py script
1392            - openerp-client <unknown> (embed)
1393            NOTE: embeds msgfmt.py script
1394            - rapidsvn <unknown> (embed)
1395            NOTE: embeds msgfmt.py script
1396            - wammu <unknown> (embed)
1397            NOTE: embeds msgfmt.py script
1398            - gaphor <unknown> (embed)
1399            NOTE: embeds msgfmt.py script
1400            - pida <unknown> (embed)
1401            NOTE: embeds msgfmt.py script
1402            - python-formencode <unknown> (embed)
1403            NOTE: embeds msgfmt.py script
1404            - duplicity <unfixed> (embed)
1405            NOTE: embeds stdlib module: urlparse, tarfile
1406            - pygopherd <unfixed> (embed)
1407            NOTE: embeds stdlib module: zipfile
1408    
1409    argparse
1410            - twill <unfixed> (embed; bug #555347)
1411            - ipython <unfixed> (embed; bug #555348)
1412    
1413    coherence
1414            - elisa <unfixed> (embed; bug #555335)
1415    
1416    simpletal
1417            - plastex <unfixed> (embed; bug #555371)
1418    
1419    flickrpc (not packaged in Debian, http://burtonini.com/bzr/flickrpc/)
1420            - postr <unfixed> (embed)
1421            - elisa <unfixed> (embed)
1422    
1423    simplegeneric (not packaged in Debian, http://pypi.python.org/pypi/simplegeneric)
1424            - apertium-tolk <unfixed> (embed)
1425            - ipython <unfixed> (embed)
1426            - virtaal <unfixed> (embed)
1427    
1428    distribute
1429            - setuptools <removed> (old-version)
1430    
1431    rails
1432            - jruby1.2 <removed> (embed) [./bench/rails/*]
1433            NOTE: jruby is in non-free, it probably includes rails too
1434            - libgettext-ruby <unfixed> (embed) [./samples/rails/*]
1435            - libopenid-ruby <unfixed> (embed) [./examples/rails_openid/*]
1436            - thin <unfixed> (embed) [./spec/rails_app/*]
1437            NOTE: this is a subdirectory of examples, which in general is a non-issue, but may
1438            NOTE: be dangerous if developers are naively basing their code off of the examples
1439            NOTE: prototype.js is among the example files
1440    
1441    lucene2 (prototype.js is among the embeds in the following)
1442            - lucene <unfixed> (old-version)
1443            - pylucene <unfixed> (embed)
1444            - libpdfbox-java <unfixed> (embed)
1445            - libfontbox-java <unfixed> (embed)
1446            - libjempbox-java <unfixed> (embed)
1447            - solr <unfixed> (embed)
1448    
1449    unicode-data
1450            - syslinux <unfixed> (embed)
1451            - camomile <unfixed> (embed)
1452            - fribidi <unfixed> (embed)
1453            - m17n-db <unfixed> (embed)
1454            - sbcl <unfixed> (embed)
1455            - heimdal <unfixed> (embed)
1456            - icu <unfixed> (embed)
1457            - icu4j <unfixed> (embed)
1458            - krb5 <unfixed> (embed)
1459            - moodle <unfixed> (embed)
1460            - openldap <unfixed> (embed)
1461            - pike7.6 <unfixed> (embed)
1462            - samba <unfixed> (embed)
1463            - samba4 <unfixed> (embed)
1464            - cmucl <unfixed> (embed)
1465            - typo3-src <unfixed> (embed)
1466            - mauve <unfixed> (embed)
1467            - texlive-bin <unfixed> (embed)
1468            - ypsilon <unfixed> (embed)
1469            - jeuclid <unfixed> (embed)
1470            - charmap.app <unfixed> (embed)
1471            - clisp <unfixed> (embed)
1472            - gnulib <unfixed> (embed)
1473            - opensrs-client <unfixed> (embed)
1474            - saxonb <unfixed> (embed)
1475            - rails <unfixed> (embed)
1476    
1477    feedparser
1478            - rawdog <unfixed> (embed; bug #383422)
1479            - miro <unfixed> (embed; bug #555351)
1480            - calibre <unfixed> (embed; bug #555352)
1481            - freevo <unfixed> (embed; bug #555353)
1482            - pida <unfixed> (embed; bug #555354)
1483            - planet-venus <unfixed> (embed; bug #555355)
1484            - plone3 <removed> (embed; bug #555356)
1485            - exaile 0.2.14+debian-1 (embed)
1486            - screenlets 0.1.2-3 (embed)
1487            NOTE: included twice
1488    
1489    agg:
1490            - matplotlib <unfixed> (embed: bug #377271)
1491            - contextfree <unfixed> (embed)
1492            NOTE: since 2.2-1 it links statically to system libagg, but still uses the embedded copy
1493            - exactimage <unfixed> (embed)
1494            - python-enable <unfixed> (embed)
1495            - mapnik 0.5.1-3 (embed)
1496            NOTE: links statically to agg, but shared library is not available (bug #377271)
1497    
1498    vtk
1499            - paraview <unfixable> (embed; bug #495426)
1500    
1501    txt2tags
1502            - rednotebook <unfixed> (embed)
1503    
1504    htmltextview (not packaged in Debian, http://www.gnome.org/~gjc/htmltextview.py)
1505            - gajim <unfixed> (embed)
1506            - emesene <unfixed> (embed)
1507            - convirt <unfixed> (embed)
1508            - pida <unfixed> (embed)
1509            - rednotebook <unfixed> (embed)
1510    
1511    horde3 (prototype.js is among the embeds in the following)
1512            - mnemo2 <unfixed> (embed)
1513            - nag2 <unfixed> (embed)
1514            - wordpress <unfixed> (embed)
1515            NOTE: Text_Diff (wp-includes/Text/Diff*)
1516    
1517    cimg
1518            - gmic <unfixed> (embed)
1519    
1520    mootools
1521            - kdenetwork <unfixed> (embed)
1522            - gallery <unfixed> (embed)
1523            - jspwiki <unfixed> (embed)
1524            - vdr-plugin-live <unfixed> (embed)
1525            - perl-doc-html <unfixed> (embed)
1526    
1527    openldap
1528            - openldap2.3 <removed> (old-version)
1529    
1530    grub2
1531            - grub <unfixed> (old-version)
1532    
1533    gnupginterface
1534            - duplicity <unfixed> (embed)
1535    
1536    python-dateutil
1537            - awn-extras-applets <unfixed> (embed)
1538            - matplotlib <unknown> (embed)
1539    
1540    cups
1541            - cupsys <removed> (old-version)
1542    
1543    yui
1544            - bcfg2 <not-affected> (present in source but not included in any binary files)
1545            - serendipity 1.5.3-1 (embed; bug #557746)
1546            - moodle 1.8.2.dfsg-5 (embed)
1547            - jifty 0.91117-1 (embed; bug #557748)
1548            - webgui 7.7.26-1 (embed)
1549            - loggerhead 1.17-1 (embed)
1550            - otrs2 2.4.7+dfsg1-1 (embed; bug #592146)
1551    
1552    quake3 (vanilla source not packaged in debian)
1553            - openarena <unfixable> (fork)
1554    
1555    quake2 (vanilla source not packaged in debian)
1556            - alien-arena <unfixable> (fork)
1557            - warsow <unfixable> (fork)
1558    
1559    libtheora
1560            - iceweasel <not-affected> (uses xulrunner)
1561            - xulrunner <unfixed> (embed; bug #540959)
1562            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1563            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1564            - iceape <unfixed> (embed; bug #559276)
1565            [etch] - iceape <not-affected> (introduced in iceape 2.0)
1566            [lenny] - iceape <not-affected> (introduced in iceape 2.0)
1567    
1568    dtoa
1569            - bfilter <unfixed> (embed)
1570            - cacao <removed> (embed)
1571            - cdrdao <unfixed> (embed)
1572            - classpath <unfixed> (embed)
1573            - freej <unfixed> (embed)
1574            - iceape <unfixed> (embed)
1575            - iceweasel <unfixed> (embed)
1576            - jscoverage <unfixed> (embed)
1577            - kde4libs <unfixed> (embed)
1578            - kdelibs <unfixed> (embed)
1579            - kompozer <unfixed> (embed)
1580            - libv8 <unfixed> (embed)
1581            - mono <unfixed> (embed)
1582            - newlib <unfixed> (embed)
1583            - nspr <unfixed> (embed)
1584            - php5 <unfixed> (embed)
1585            - polyml <unfixed> (embed)
1586            - qt4-x11 <unfixed> (embed)
1587            - rhino <unfixed> (embed)
1588            NOTE: code translated to Java
1589            - ruby1.8 <unfixed> (embed)
1590            - ruby1.9 <unfixed> (embed)
1591            - ruby1.9.1 <unfixed> (embed)
1592            - sdd <unfixed> (embed)
1593            - sfind <unfixed> (embed)
1594            - star <unfixed> (embed)
1595            - tinymux <unfixed> (embed)
1596            - virtualbox-ose <unfixed> (embed)
1597            - webkit <unfixed> (embed)
1598            - xulrunner <unfixed> (embed)
1599    
1600    ipc (not packaged in Debian; see http://mozdev.org/pipermail/enigmail/2009-November/011678.html)
1601            - firegpg <unfixed> (embed)
1602            - enigmail <unfixed> (embed)
1603    
1604    ptmalloc (not packaged in Debian)
1605            - crystalspace <unfixed> (embed)
1606            - qt4-x11 <unfixed> (embed)
1607    
1608    svgalib
1609            - usplash <unfixed> (embed)
1610    
1611    bogl
1612            - usplash <unfixed> (embed)
1613    
1614    taglist
1615            - usplash <unfixed> (embed)
1616    
1617    portaudio
1618            - audacity <unfixed> (embed; bug #323711)
1619    
1620    nyquist
1621            - audacity <unfixed> (embed)
1622            NOTE: embeds a forked nyquist with support for a shared library
1623    
1624    vamp-plugin-sdk
1625            - audacity <unfixed> (embed)
1626    
1627    wordpress
1628            - libwordpress-xmlrpc-perl <removed> (embed) [./xmlrpc.php]
1629            - wordpress-mu <removed> (fork)
1630    
1631    php5
1632            - php4 <removed> (old-version)
1633    
1634    classpath
1635            - libgnucrypto-java <removed> (embed; bug #559788)
1636    
1637    libtool
1638            - apr <unfixed> (static; bug #489625)
1639            NOTE: ships copy of libtool in libapr1-dev; was 'embed' before 1.3.2-3
1640            - arts <unfixed> (embed)
1641            - bochs 2.4.2-1 (embed; bug #560884)
1642            - camserv <unfixed> (embed)
1643            - collectd 4.8.2-1 (embed)
1644            - courier-authlib 0.58-4 (embed)
1645            NOTE: The etch version of courier-authlib was the earliest version checked, might be fixed earlier
1646            - cvsnt 2.5.04.3236-1.2 (embed)
1647            - dico <not-affected> (Uses the system copy of ltdl)
1648            - freeradius 0.1+20010527-1 (embed)
1649            NOTE: Earliest reference I could find from the changelog is from 27 May 2001
1650            - ggobi 2.1.9~20091212-1 (embed)
1651            - glame 2.0.1-4 (embed)
1652            NOTE: The etch version of glame was the earliest version checked, might be fixed earlier
1653            - gnash 0.8.7-2 (embed)
1654            - gnu-smalltalk <unfixed> (embed; bug #566777)
1655            - google-gadgets 0.10.5-0.3 (embed)
1656            NOTE: 0.10.5-0.3 was the earliest version checked, was fixed earlier
1657            - graphicsmagick 1.3.5-6 (embed)
1658            - graphviz 2.8-3 (embed)
1659            NOTE: The etch version of graphviz was the earliest version checked, might be fixed earlier
1660            - guile-1.6 1.6.8-7 (embed)
1661            - hamlib 1.2.11-1 (embed)
1662            - hercules 3.06-1.2 (embed)
1663            - jags 1.0.4-3 (embed; bug #560864)
1664            - kdelibs <unfixed> (embed)
1665            - libannodex <removed> (embed)
1666            - libextractor 0.5.23+dfsg-4 (embed)
1667            - libmcrypt <not-affected> (libtool source present but not included in any of the binary packages)
1668            - libtunepimp 0.5.3-7.3 (embed)
1669            - mp4h 1.3.1-4.1 (embed)
1670            - naim <removed> (embed)
1671            - parser-mysql <unfixed> (embed)
1672            - pinball 0.3.1-11 (embed)
1673            - redland <unfixed> (embed)
1674            - siproxd <unfixed> (embed)
1675            - ski <unfixed> (embed)
1676            - synfig 0.62.00-1 (embed)
1677            - unixodbc 2.2.4-5 (embed)
1678            - xmlsec1 <not-affected> (Doesn't enable dynamic loading of crypto modules)
1679            - clamav 0.95+dfsg-1 (embed)
1680            - imagemagick 6:6.2.3.1-1 (embed)
1681            - hypre 2.4.0b-5 (embed)
1682            - lam <unfixed> (embed)
1683            - openmpi <unfixable> (embed; bug #559386)
1684            - parser <unfixed> (embed)
1685            - pdsh 2.18-5 (embed; bug #560892)
1686            - sbnc 1.2-8 (embed)
1687            - sdcc <unfixed> (embed)
1688            - wml <not-affected> (The embedded ltdl isn't used, instead mp4h is used, see 559841)
1689            - proftpd-dfsg <unfixed> (embed; bug #561748)
1690            - babel 1.4.0.dfsg-5 (embed)
1691            - libprelude 0.9.14-2 (embed)
1692            - heartbeat 2.1.4-7 (embed)
1693            NOTE: From Squeeze onwards the system copy of ltdl is used, use the current version from Squeeze,
1694            NOTE: might've been fixed earlier
1695            - gcc-* <unknown> (embed)
1696    
1697    ocamlgsl
1698            - orpie 1.5.1-7.1 (embed; bug #550058)
1699    
1700    xdotool
1701            - keynav <unfixed> (embed; bug #560103)
1702    
1703    bulletphysics (not packaged; http://www.bulletphysics.org/)
1704            - supertuxkart <unfixed> (embed)
1705            - blender <unfixed> (embed)
1706    
1707    ghostscript
1708            - gs-gpl <removed> (old-version)
1709    
1710    icedove
1711            - thunderbird <removed> (old-version)
1712    
1713    sizzlejs (not packaged in Debian, http://sizzlejs.com/)
1714            - jquery <unfixed> (embed)
1715    
1716    sed
1717            - ssed <unfixed> (fork)
1718    
1719    phpatomlib (http://code.google.com/p/phpatomlib)
1720            - wordpress <unfixed> (embed)
1721    
1722    Services_JSON (http://pear.php.net/package/Services_JSON)
1723            - wordpress <unfixed> (embed)
1724    
1725    phpass (http://www.openwall.com/phpass/)
1726            - gallery2 <unfixed> (embed)
1727            - wordpress <unfixed> (embed)
1728            - typo3-src <unfixed> (modified-embed)
1729            NOTE: file refers to drupal, maybe there's a copy somewhere there
1730            NOTE: a copyright owner search didn't match anything
1731            - libauthen-passphrase-perl <unfixable> (fork)
1732            NOTE: perl implementation of phpass
1733    
1734    squirrelmail
1735            - wordpress <unfixed> (embed)
1736            NOTE: class-pop3.php
1737    
1738    ezSQL (http://www.woyano.com/jv/ezsql)
1739            - wordpress <unfixable> (fork)
1740            NOTE: wp-db.php
1741    
1742    Diff.php (Clay Loveless' version/killersoft.com)
1743            - php-versioncontrol-svn <unfixed>
1744    
1745    libm (provided by libc)
1746            - spring <unfixed> (embed)
1747            NOTE: embedded by embedded copy of streflop
1748            - aide <unfixed> (static)
1749            - busybox <unfixed> (static)
1750            - mindi-busybox <unfixed> (static)
1751            - qemu <unfixed> (static)
1752            NOTE: qemu-user-static
1753            - tuxonice-userui <unfixed> (static)
1754            - zsh <unfixed> (static)
1755            NOTE: zsh-static
1756            - tripwire <unfixed>
1757    
1758    streflop
1759            - spring <unfixed> (embed)
1760    
1761    minizip
1762            - spring <unfixed> (embed)
1763    
1764    oscpack
1765            - spring <unfixed> (embed)
1766    
1767    hpiutil2
1768            - spring <unfixed> (embed)
1769    
1770    p7zip
1771            - spring <unfixed> (embed)
1772    
1773    pythonqt (doesn't seem to be python-qtN, unknown source)
1774            - fontmatrix <unfixed> (embed)
1775            - elmerfem <unfixed> (embed)
1776    
1777    iepngfix (not packaged in Debian; http://www.twinhelix.com/css/iepngfix/)
1778            - docvert <unfixed> (embed)
1779            - jifty <unfixed> (embed)
1780            - kdenetwork <unfixed> (embed)
1781            - mediatomb <unfixed> (embed)
1782            - plastex <unfixed> (embed)
1783            - plone3 <removed> (embed)
1784            - python-chaco <unfixed> (embed)
1785            - python-docutils <unfixed> (embed)
1786            - s5 <unfixed> (embed)
1787            - zope2.10 <unfixed> (embed)
1788            - zope2.11 <removed> (embed)
1789            - cython <not-affcted> (embed)
1790            NOTE: part of documentation, which is not installed into the binary package
1791    
1792    python-docutils
1793            - zope2.10 <unfixed> (embed)
1794            - zope2.11 <removed> (embed)
1795    
1796    tesseract
1797            - ocropus <unfixed> (static)
1798    
1799    antlr
1800            - kdevelop <unfixed> (embed)
1801    
1802    libxerces2
1803            - openjdk-6 <unfixed> (embed)
1804    
1805    kfreebsd-8
1806            - kfreebsd-7 <unfixed> (old-version)
1807            - kfreebsd-6 <removed> (old-version)
1808    
1809    ruby1.9.1
1810            - ruby1.9 <unfixed> (old-version)
1811            - ruby1.8 <unfixed> (old-version)
1812    
1813    maildrop
1814            - courier <unfixed> (embed) [./maildrop]
1815    
1816    glee
1817            - warzone2100 <not-affected> (embed)
1818    
1819    phing
1820            - symfony <unfixed> (embed)
1821    
1822    pake
1823            - symfony <unfixed> (embed)
1824    
1825    propel
1826            - symfony <unfixed> (embed)
1827    
1828    creole
1829            - symfony <unfixed> (embed)
1830    
1831    hfsutils
1832            - cdrkit <unfixed> (embed; bug #570187)
1833            NOTE: embeds hfsutils code in genisoimage
1834    
1835    cdrkit
1836            - grub2 <unfixed> (embed; bug #570156)
1837            NOTE: genisoimage imported into grub-mkisofs
1838    
1839    kdebase-workspace
1840            - kdebase <unfixed> (old-version)
1841    
1842    file
1843            - php5 <unfixable> (modified-embed)
1844            [lenny] - php5 <not-affected>
1845    
1846    cdb
1847            - php5 <unfixed> (embed)
1848    
1849    libmbfl (itp: #570708)
1850            - php5 <unfixed> (embed)
1851            NOTE: PHP is actually the current upstream, ITP is of that code
1852    
1853    libonig
1854            - php5 5.3.2-1 (embed)
1855    
1856    xmlrpc-epi
1857            - php5 <unfixed> (embed)
1858    
1859    swt-gtk
1860            - eclipse <unfixed> (embed; bug #538808)
1861    
1862    txt2html
1863            - wml 2.0.11ds2-1 (embed)
1864    
1865    ca-certificates
1866            - nss <not-affected> (certificates are in source, but not included in any of the binary packages)
1867    
1868    openexr
1869            - freeimage <unfixed> (embed)
1870    
1871    libmng
1872            - freeimage <unfixed> (embed)
1873    
1874    openjpeg
1875            - freeimage <unfixed> (embed)
1876    
1877    libjpeg6b
1878            - freeimage <unfixed> (embed)
1879    
1880    libjpeg (don't know what exact version)
1881            - dcmtk <unfixed>
1882            - gdcm <unfixed>
1883            - insighttoolkit <unfixed>
1884            - openarena <unfixed> (bug #495966)
1885            - outguess <unfixed>
1886            - squeak-vm <unfixed> (embed)
1887            - tremulous <unfixed>
1888            - tuxonice-userui <unfixed> (static)
1889            - fpc <unfixed> (static)
1890            - lazarus <unfixed> (static)
1891            NOTE: inherited from fpc, see #472304
1892            - mseide-msegui <unfixed> (static)
1893            NOTE: inherited from fpc, see #472304
1894            - easymp3gain <unfixed> (static)
1895            NOTE: inherited from fpc, see #472304
1896            - winff <unfixed> (static)
1897            NOTE: inherited from fpc, see #472304
1898            - texlive-bin <not-affected> (included in upstream source as dependency of libgd2, but not built or included in any of the binary packages)
1899    
1900    
1901    lxr
1902            - lxr-cvs <unfixed> (embed)
1903    
1904    libfile-copy-recursive-perl
1905            - r-base <unfixed> (embed; bug #577427)
1906            - r-base-core-ra <unfixed> (embed; bug #577429)
1907    
1908    delimmatch
1909            - r-base <unfixed> (embed; bug #577433)
1910            - r-base-core-ra <unfixed> (embed; bug #577434)
1911    
1912    libsmf (ITP: #572558)
1913            - denemo <unfixed> (embed)
1914            NOTE: http://lists.debian.org/debian-mentors/2010/04/msg00269.html
1915    
1916    libselinux
1917            - dpkg 1.15.6 (static)
1918    
1919    xinha (ITP: #479708)
1920            - horde3 <unfixed>
1921            - serendipity <unfixed>
1922            - openacs <unfixed>
1923            - dotlrn <unfixed>
1924    
1925    dvipng
1926            - texlive-bin <not-affected> (code present in source but not included in the binary packages)
1927    
1928    dvipdfmx
1929            - texlive-bin <unfixed> (embed)
1930            NOTE: this is intentionally part of the package now, and the separate dvipdfmx package has been removed from sid/squeeze
1931    
1932    lcdf-typetools
1933            - texlive-bin 2009-1 (embed)
1934    
1935    tex4ht
1936            - texlive-bin 2009-1 (embed)
1937    
1938    freetype
1939            - texlive-bin 2009-1 (embed)
1940    
1941    freetype2
1942            - texlive-bin 2009-1 (embed)
1943    
1944    silgraphite
1945            - texlive-bin <unfixed> (embed)
1946    
1947    unzip
1948            - texlive-bin 2009-1 (embed)
1949    
1950    jbig2dec
1951            - ghostscript 8.71~dfsg2-1 (embed)
1952    
1953    libxml2
1954            - chromium-browser 5.0.375.29~r46008-1
1955    
1956    protobuf
1957            - chromium-browser 5.0.375.70~r48679-2
1958    
1959    libv8
1960            - chromium-browser 5.0.375.38~r46659-1
1961    
1962    nspr
1963            - chromium-browser 5.0.375.29~r46008-3
1964    
1965    yasm
1966            - chromium-browser 5.0.375.29~r46008-2
1967    
1968    libxslt
1969            - chromium-browser 5.0.375.29~r46008-1
1970    
1971    miniupnpc (not packaged in Debian; ITP bug #444392)
1972            - warzone2100 <unfixed> (embed)
1973    
1974    iniparser (not packaged in Debian; RFP bug #582657)
1975            - warzone2100 <unfixed> (modified-embed)
1976    
1977    pyglet
1978            - sympy <unfixed> (embed; bug #459716)
1979    
1980    mpmath
1981            - sympy <unfixed> (embed; bug #541746)
1982    
1983    curl
1984            - criticalmass <unfixed> (static; bug #599061)
Legend:
Removed from v.7924  
changed lines
  Added in v.15416
  ViewVC Help
Powered by ViewVC 1.1.5