/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 4891 by neilm, Sat Oct 28 11:05:37 2006 UTC revision 7924 by stef-guest, Mon Jan 14 23:05:37 2008 UTC
# Line 1  Line 1 
1  This file collects cases, where a source package embeds code from  Embedded code copies
2  other projects, without linking dynamically:  ====================
   
 xpdf code: (some use xpdf 2, some xpdf 3)  
 gpdf (will be replaced by evince in Gnome 2.12)  
 pdftohtml (current poppler source package has a ported version, pinged maintainer)  
 kdegraphics/kpdf (upstream is working on using poppler, probably not in time for Etch)  
 tetex-bin (links to poppler since 3.0-12)  
 cupsys (only older releases, recent ones use xpdf-utils, it's still present in the src, though)  
 poppler  
 koffice (upstream is working on using poppler, probably not in time for Etch)  
 libextractor (uses internal pdf decoder since 0.5.12-1)  
 pdfkit.framework (links to poppler since 0.8-4)  
   
 zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  
 dpkg  
 rsync (somehow derived code base)  
 mozilla(?)  
 Linux kernels  
 pvpgn (links dynamically since 1.7.8-2)  
 mrtg (links dynamically since 2.12.2-1)  
   
 libgadu/ekg:  
 centericq  
 gaim  
 kopete (ships the code, but links dynamically in the Debian package)  
 kadu (not packaged in Debian)  
 GNU gadu (not yet packaged in Debian)  
   
   
 xmlrpc: (which package is the "origin" of this code?)  
 drupal  
 phpgroupware  
 egroupware  
 phpwiki  
 php4 (php-pear, IIRC this was reorganized some weeks ago?)  
 tikiwiki (not packaged in Debian)  
   
   
 shtool: (affects build-time only)  
 mysql-ocaml  
 php4  
   
   
 mozilla:  
 mozilla-firefox  
 mozilla-thunderbird  
 nvu  
   
   
 xli:  
 xloadimage  
   
   
 lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)  
 openmotif  
 xfree86/xorg (in libxpm)  
   
   
 kerberized apps with BSD origin:  
 krb4  
 krb5  
 heimdal  
3    
4    This file collects cases, where a source package embeds code from
5    other projects which is considered bad for fixing security flaws
6    because the fix needs to be applied in multiple source packages.
7    
8  grip: (which pkg is the origin?)  Format:
9  libcdaudio  <srcpkg> (<optional comment about srcpkg>)
10  grip          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11  gnome-vfs (vfs2 as well?)          NOTE: optional comments about the linkage of the embedding srcpkg
12    
13    status: version number fixing the embedded copy, <unfixed>, <removed>, <itp> or <unknown> if the version number can not be determined
14  fudforum:  sort: static (linking statically against a lib)
15  phpgroupware-fudforum        embed (embedding a copy of the library into another source package)
16  egroupware-fudforum        fork (the package is not just embedding code but it is a fork and thus might share parts of the source code)
17    
18  cvs:  The srcpkg might be some string to identify the code if there is no specific source package.
19  gcvs (at least an additional script is included, check if there's more)  
20    Everything up to the next line is ignored
21  pcre:  ---BEGIN
22  all pythons  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
23  php4 (src included, but Debian package links dynamically)          NOTE: Fixed packages link to poppler library unless otherwise noted
24  analog (src included, but Debian package links dynamically)          - gpdf <removed>
25  libgoffice-1          [sarge] - gpdf <unfixed>
26  tf5 (since 5.0beta7 the Debian package links dynamically)          NOTE: has been replaced by evince in etch
27            - pdftohtml <unknown>
28  tiff:          [sarge] - pdftohtml <unfixed>
29  wxpythongtk (check, which debian pkg this is in)          [etch] - pdftohtml <unfixed>
30  older kdegraphics/kpdf releases < 3.3 embedded a copy          NOTE: has been replaced by poppler-utils
31            - kdegraphics <unfixed> (embed; bug #436164)
32            NOTE: the kpdf replacement in KDE 4 is using poppler
33  uudeview:          - tetex-bin 3.0-12 (embed)
34  libconvert-uulib-perl          - texlive-bin 2007-1 (embed)
35            NOTE: links to poppler
36  sqlite: (not affected by security vulnerabilities so far)          - koffice <unfixed> (embed; bug #436163)
37  amarok          - libextractor 0.5.12-1 (embed)
38            NOTE: libextractor is using its own pdf decoder now
39            - libextractor 0.5.12-1 (embed)
40            - pdfkit.framework 0.8-4 (embed)
41            - ipe <unfixed> (embed)
42            NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
43            - ruby-gnome2 <unknown> (embed)
44            NOTE: copy only present in source but links to poppler
45    
46    ppmd
47            - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
48    
49    silc-toolkit
50            - silc-client 1.1~beta6-1 (embed)
51    
52    dietlibc
53            - ccontrol 0.9.1+20071204-1 (static)
54    
55    libiax
56            - iaxmodem <unfixed> (embed)
57    
58    zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
59            - dpkg <unfixed> (embed)
60            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
61            - rsync <unfixed> (embed)
62            NOTE: somehow derived code base
63            - mono <unfixed> (embed)
64            TODO: check mozilla
65            - Linux kernels <unfixed> (embed)
66            - pvpgn 1.7.8-2 (embed)
67            - mrtg 2.12.2-1 (embed)
68            - rpm <unknown> (embed)
69            NOTE: pinged anibal since when rpm was fixed
70    
71    libbz2
72            - dpkg <unfixed> (static)
73    
74    ekg
75            - centericq <unfixed> (embed)
76            - gaim <unfixed> (embed)
77            - pigdin <unfixed> (embed)(links dynamically against libgadu)
78            - kopete 4:3.3.2-5 (embed)
79            - kadu <unfixed> (embed)
80            - gadu <unfixed> (embed)
81            NOTE: g/kadu not packaged in Debian yet
82    
83    xmlrpc (which package is the "origin" of this code?)
84            - drupal <unfixed> (embed)
85            - phpgroupware <unfixed> (embed)
86            - egroupware <unfixed> (embed)
87            - phpwiki (embed)
88            - php4 <unfixed> (embed)
89            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
90    
91    shtool (affects build-time only)
92            - mysql-ocaml <unfixed> (embed)
93            - php4 <unfixed> (embed)
94    
95    mozilla source code
96            - mozilla-firefox <unfixed> (embed)
97            - mozilla-thunderbird
98            - firefox <removed>
99            [etch] - firefox <unfixed> (embed)
100            - thunderbird <removed>
101            [etch] - thunderbird <unfixed> (embed)
102            - iceweasel <unfixed> (embed)
103            - iceape <unfixed> (embed)
104            - icedove <unfixed> (embed)
105            - xulrunner <unfixed> (embed)
106            - nvu <removed> (embed)
107    
108    xli
109            - xloadimage <unfixed> (embed)
110    
111    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
112            - openmotif <unfixed> (embed)
113            - xfree86/xorg <unfixed> (embed)
114            NOTE: in libxpm
115    
116    kerberized apps with BSD origin
117            - krb4 <unfixed> (embed)
118            - krb5 <unfixed> (embed)
119            - heimdal <unfixed> (embed)
120    
121    grip (which pkg is the origin?)
122            - libcdaudio
123            - grip
124            - gnome-vfs
125            TODO: check vfs2 as well
126    
127    fudforum
128            - phpgroupware-fudforum <unfixed> (embed)
129            - egroupware-fudforum <removed>
130            [sarge] - egroupware-fudforum <unfixed> (embed)
131    
132    cvs
133            - gcvs <unfixed> (embed)
134            NOTE: see cvsunix/src in tarball
135    
136    pcre
137            - python* <unfixed> (embed)
138            - php4 <unknown> (embed)
139            - analog 2:5.23-0woody1 (embed)
140            - libgoffice-1 <unfixed> (embed)
141            - vfu 4.06-4.1 (embed; bug #450754)
142            - tf5 5.0beta7-1 (embed)
143            - monotone <unfixed> (embed)
144            NOTE: this only affects versions >= 0.37
145            - glib <unfixed> (embed)
146            NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic
147            - apache2 2.0.53-4 (embed)
148            - exim4 4.10-0.srh20.12 (embed)
149            - yacas <unfixed> (embed)
150            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
151            - gtamsanalyzer.app 0.42-5 (embed)
152    
153    tiff
154            - wxpythongtk <unfixed> (embed)
155            TODO: check, which debian pkg this is in
156    
157    uudeview
158            - libconvert-uulib-perl <unfixed> (embed)
159    
160    sqlite (not affected by security vulnerabilities so far)
161            - amarok <unfixed> (embed)
162            - monotone <unfixed> (embed)
163            - iceweasel <unfixed> (embed)
164    
165    util-linux/mount
166            - loop-aes-utils <unfixed> (embed)
167            NOTE: contains code from util-linux' mount in the mount-aes-udeb
168    
169    webmin
170            - usermin <unknown> (embed)
171            [sarge] - usermin <unfixed> (embed)
172    
173    sylpheed
174            - sylpheed-claws <unfixed> (fork)
175    
176    phpsysinfo
177            - egroupware <unfixed> (embed)
178            - phpgroupware <unfixed> (embed)
179    
180    phpldapadmin
181            [sarge] - egroupware <unfixed> (embed)
182            NOTE: removed from egroupware after sarge
183    
184    chmlib
185            - kchmviewer <unknown> (embed)
186    
187    libavcodec/libavformat (source: ffmpeg)
188            - mplayer <unfixed> (embed; bug #395252)
189            - xvidcap <unfixed> (embed)
190            - kino <unfixed> (static)
191            - vlc <unfixed> (static)
192            - smilutils <unfixed> (static)
193            - motion <unfixed> (static)
194            - gst-ffmpeg <unfixed> (embed)
195            - gstreamer0.10-ffmpeg <unfixed> (embed)
196            - xmovie <unfixed>
197            TODO: gimp-gap (potentially using ffmpeg code as well)
198    
199    mad MPEG decoding lib
200            - mad <unfixed> (embed)
201            - xine-lib <unfixed> (embed)
202    
203  util-linux/mount:  libdts
204  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb          - xine-lib <unfixed> (embed)
205    
206  webmin:  flac
207  usermin          - xine-lib <unfixed> (embed)
208    
209  sylpheed:  liba52
210  sylpheed-claws          - a52dec <unfixed> (embed)
211            - xine-lib <unfixed> (embed)
212    
213  phpsysinfo:  libmpeg2
214  egroupware          - mpeg2dec <unfixed> (embed)
215  phpgroupware          - xine-lib <unfixed> (embed)
216    
217  phpldapadmin:  curl
218  egroupware          - wget <unfixed> (embed)
219            NOTE: code for NTLM authentication
220    
221  chmlib:  uw-imap
222  kchmviewer (not packaged in Debian)          - pine <unfixed> (embed)
223            - alpine <unfixed> (embed)
224    
225  libavcodec/libavformat:  imagemagick
226  ffmpeg          - graphicsmagick <unfixed> (fork)
 xine-lib  
 xvidcap (currently in NEW)  
 kino (links statically, does not include code)  
 vlc (links statically, does not include code)  
 smilutils (links statically, does not include code)  
 motion (links statically, does not include code)  
 gst-ffmpeg  
 xmovie (currently in NEW)  
 gst-ffmpeg  
227    
228  mad MPEG decoding lib:  halibut
229  mad          - nsis <unfixed> (embed)
 xine-lib  
230    
231  libdts:  libghttp
232  libdts          - hotway <unfixed> (embed)
 xine-lib  
233    
234  flac:  libsndfile
235  flac          - ardour <unfixed> (embed)
 xine-lib  
236    
237  liba52:  glibmm2.4
238  a52dec          - ardour <unfixed> (embed)
 xine-lib  
239    
240  libmpeg2:  libgnomecanvasmm2.6
241  mpeg2dec          - ardour <unfixed> (embed)
 xine-lib  
242    
243  curl:  libsigc++-2.0
244  wget (code for NTLM authentication)          - ardour <unfixed> (embed)
245    
246  TODO evaluate:  soundtouch
247  gimp-gap (potentially using ffmpeg code as well)          - ardour <unfixed> (embed)
248    
249  uw-imap:  libmms
250  pine          - xine-lib <unfixed> (embed)
251            - mimms <unfixed> (embed)
252    
253  imagemagick:  fckeditor
254  graphicsmagick          - knowledgeroot <unfixed> (embed)
255            - moin <unfixed> (embed; bug #452599)
256            - karrigell <unfixed> (embed; bug #452598)
257            - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
258    
259  halibut:  ipatlas (not packaged in Debian)
260  nsis          - moodle <unfixed> (embed)
261    
262  libghttp:  libphp-phpmailer
263  hotway          - moodle <unfixed> (embed)
264    
265  etl-dev (will be renamed to libetl-dev soon):  htmlArea (not packaged in Debian)
266  synfig          - moodle <unfixed> (embed)
267    
268  libmms:  bennu (not packaged in Debian)
269  xine-lib          - moodle <unfixed> (embed)
 mimms  
270    
271  FCKeditor:  smarty:
272  knowledgeroot          - moodle <unfixed> (embed)
273    
 Moodle contains lots of things:  
 AdoDB  
 AdoDB-XML Schema  
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
274  TinyMCE  TinyMCE
275  bennu          - wordpress <unfixed> (embed)
276            - moodle <unfixed> (embed)
277            - knowledgeroot <unfixed> (embed)
278  TinyMCE:          - joomla <itp> (bug #326398)
279  wordpress  
280  moodle  scintilla
281  knowledgeroot          - scite <unfixed> (embed)
282  joomla (ITP)          - qscintilla <unfixed> (embed)
283            - qscintilla2 <unfixed> (embed)
284  scintilla:          - geany <unfixed> (embed)
285  scite  
286  qscintilla  libphp-adodb
287  geany          - moodle <unfixed> (embed)
288            NOTE: also AdoDB-XML Schema
289  libphp-adodb:          - gallery2 <unfixed> (embed)
290  gallery2          - phppgadmin <unfixed> (embed)
291  phppgadmin          - egroupware <unfixed> (embed)
292  egroupware          - phpwiki <unfixed> (embed)
293  phpwiki          - ipplan <unfixed> (embed)
294  moodle          - typo3 <unfixed> (embed)
295  cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)          - moodle <unfixed> (embed)
296            - cacti <unknown> (embed)
297  gzip:          [sarge] - cacti <unfixed> (embed)
298  linux-kernel (lib/inflate.c)          NOTE: dependency exists, but internal version is used
299  klibc (based on linux-kernel gzip code)  
300  busybox  gzip
301            - linux-kernel <unfixed> (embed)
302  ffmpeg:          NOTE: lib/inflate.c
303  mplayer (#395252)          - klibc <unfixed> (embed)
304            NOTE: based on linux-kernel gzip code
305  neon:          - busybox <unfixed> (embed)
306  cadaver (all, but being worked on: #188381)  
307  gnome-vfs2 (#395874)  neon
308  litmus (#395875)          - cadaver <unfixed> (embed; bug #188381)
309  screem (sarge only)          - gnome-vfs2 <unfixed> (embed; bug #395874)
310  sitecopy (#395876)          - litmus <unfixed> (embed; #395875)
311  tla (etch/sid only: #395877)          [sarge] - screem <unfixed> (embed)
312            - sitecopy <unfixed> (embed; bug #395876)
313            [etch] - tla <unfixed> (embed; bug #395877)
314            [sarge] - tla <unfixed> (embed; bug #395877)
315    
316    libmodplug
317            - gst-plugins-bad0.10 <unfixed> (embed)
318    
319    libvncserver
320            - vino <unfixed> (embed)
321    
322    putty
323            - filezilla <unfixed> (embed)
324    
325    tinyxml (not packaged in Debian)
326            - filezilla <unfixed>
327    
328    gv
329            - evince <unfixed> (embed)
330            NOTE: ps/ tree from gv 3.5.8
331            - evince-gtk <unfixed> (embed)
332            NOTE: not packaged in Debian
333    
334    libXbae
335            [etch] - libpawlib2-lesstif <unfixed> (embed)
336            NOTE: from Cernlib
337    
338    libXaw
339            [etch] - libpawlib2-lesstif
340            NOTE: from Cernlib
341            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
342    
343    libgd2
344            - graphviz <unfixed> (embed)
345            NOTE: lib/gd seems to be 2.0.33
346    
347    rar
348            - unrar-nonfree <unfixed> (embed)
349    
350    unrar-free (maybe this code is derived from the original rar, too?)
351            - clamav <unfixed> (embed)
352            NOTE: seems to be disabled in default config
353    
354    mplayer (DirectMedia Object loader)
355            - xine-lib <unfixed> (embed)
356            NOTE: src/libw32dll/
357            - vlc <unfixed> (embed)
358            NOTE: modules/codec/dmo/
359    
360    libwpd (WordPerfect converter)
361            - openoffice.org <unfixed> (embed)
362    
363    fsplib (http://sourceforge.net/projects/fsp/)
364            - gftp <unfixed> (embed)
365            NOTE: lib/fsplib version 0.3
366    
367    librpcsecgss
368            - krb5 <unfixed> (embed)
369    
370    jasper
371            - ghostscript <unfixed> (embed)
372            - gs-gpl <unfixed> (embed)
373    
374    libidn
375            - monotone <unfixed> (embed)
376    
377    liblua
378            - monotone <unfixed> (embed)
379    
380    libbotan
381            - montone <unfixed> (embed)
382    
383    NetXX
384            - monotone <unfixed> (embed)
385    
386    libgc
387            - mono <unfixed> (embed)
388    
389    lzma
390            - p7zip <unfixed> (embed)
391    
392    lzo
393            - grub2 <unfixed> (embed)
394    
395    pax code
396            - tar <unfixed> (embed)
397            - cpio <unfixed> (embed)
398    
399    t1lib
400            - tetex-bin 2.0.2-1 (embed)
401            - texlive-bin <unknown> (embed)

Legend:
Removed from v.4891  
changed lines
  Added in v.7924

  ViewVC Help
Powered by ViewVC 1.1.5