/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 5564 by alec-guest, Wed Mar 21 01:24:37 2007 UTC revision 7985 by thijs, Sun Jan 20 10:31:59 2008 UTC
# Line 1  Line 1 
1    Embedded code copies
2    ====================
3    
4  This file collects cases, where a source package embeds code from  This file collects cases, where a source package embeds code from
5  other projects, without linking dynamically:  other projects which is considered bad for fixing security flaws
6    because the fix needs to be applied in multiple source packages.
7    
8  xpdf code: (some use xpdf 2, some xpdf 3)  Format:
9  gpdf (will be replaced by evince in Gnome 2.12)  <srcpkg> (<optional comment about srcpkg>)
10  pdftohtml (current poppler source package has a ported version, pinged maintainer)          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11  kdegraphics/kpdf (upstream is working on using poppler, probably not in time for Etch)          NOTE: optional comments about the linkage of the embedding srcpkg
12  tetex-bin (links to poppler since 3.0-12)  
13  cupsys (only older releases, recent ones use xpdf-utils, it's still present in the src, though)  status: version number fixing the embedded copy, <unfixed>, <removed>, <itp> or <unknown> if the version number can not be determined
14  poppler  sort: static (linking statically against a lib)
15  koffice/kword (upstream is working on using poppler, probably not in time for Etch)        embed (embedding a copy of the library into another source package)
16  libextractor (uses internal pdf decoder since 0.5.12-1)        fork (the package is not just embedding code but it is a fork and thus might share parts of the source code)
17  pdfkit.framework (links to poppler since 0.8-4)  
18    The srcpkg might be some string to identify the code if there is no specific source package.
19  zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  
20  dpkg  Everything up to the next line is ignored
21  rsync (somehow derived code base)  ---BEGIN
22  mozilla(?)  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
23  Linux kernels          NOTE: Fixed packages link to poppler library unless otherwise noted
24  pvpgn (links dynamically since 1.7.8-2)          - gpdf <removed>
25  mrtg (links dynamically since 2.12.2-1)          [sarge] - gpdf <unfixed>
26  rpm          NOTE: has been replaced by evince in etch
27            - pdftohtml <unknown>
28  libbz2:          [sarge] - pdftohtml <unfixed>
29  dpkg (statically linked)          [etch] - pdftohtml <unfixed>
30            NOTE: has been replaced by poppler-utils
31  libgadu/ekg:          - kdegraphics <unfixed> (embed; bug #436164)
32  centericq          NOTE: the kpdf replacement in KDE 4 is using poppler
33  gaim          - tetex-bin 3.0-12 (embed)
34  kopete (ships the code, but links dynamically in the Debian package)          - texlive-bin 2007-1 (embed)
35  kadu (not packaged in Debian)          NOTE: links to poppler
36  GNU gadu (not yet packaged in Debian)          - koffice <unfixed> (embed; bug #436163)
37            - libextractor 0.5.12-1 (embed)
38  xmlrpc: (which package is the "origin" of this code?)          NOTE: libextractor is using its own pdf decoder now
39  drupal          - libextractor 0.5.12-1 (embed)
40  phpgroupware          - pdfkit.framework 0.8-4 (embed)
41  egroupware          - ipe <unfixed> (embed)
42  phpwiki          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
43  php4 (php-pear, IIRC this was reorganized some weeks ago?)          - ruby-gnome2 <unknown> (embed)
44  tikiwiki          NOTE: copy only present in source but links to poppler
45    
46  shtool: (affects build-time only)  ppmd
47  mysql-ocaml          - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
48  php4  
49    silc-toolkit
50  mozilla:          - silc-client 1.1~beta6-1 (embed)
51  mozilla-firefox  
52  mozilla-thunderbird  dietlibc
53  firefox (to be removed)          - ccontrol 0.9.1+20071204-1 (static)
54  thunderbird (to be removed)  
55  iceweasel  libiax
56  iceape          - iaxmodem <unfixed> (embed)
57  icedove  
58  xulrunner  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
59  nvu (no longer in Debian)          - dpkg <unfixed> (embed)
60            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
61  xli:          - rsync <unfixed> (embed)
62  xloadimage          NOTE: somehow derived code base
63            - mono <unfixed> (embed)
64  lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)          TODO: check mozilla
65  openmotif          - Linux kernels <unfixed> (embed)
66  xfree86/xorg (in libxpm)          - pvpgn 1.7.8-2 (embed)
67            - mrtg 2.12.2-1 (embed)
68  kerberized apps with BSD origin:          - rpm <unknown> (embed)
69  krb4          NOTE: pinged anibal since when rpm was fixed
70  krb5  
71  heimdal  libbz2
72            - dpkg <unfixed> (static)
73  grip: (which pkg is the origin?)  
74  libcdaudio  ekg
75  grip          - centericq <unfixed> (embed)
76  gnome-vfs (vfs2 as well?)          - gaim <unfixed> (embed)
77            - pigdin <unfixed> (embed)(links dynamically against libgadu)
78  fudforum:          - kopete 4:3.3.2-5 (embed)
79  phpgroupware-fudforum          - kadu <unfixed> (embed)
80  egroupware-fudforum (removed from egroupware after sarge)          - gadu <unfixed> (embed)
81            NOTE: g/kadu not packaged in Debian yet
82  cvs:  
83  gcvs (at least an additional script is included, check if there's more)  xmlrpc (which package is the "origin" of this code?)
84            - drupal <unfixed> (embed)
85  pcre:          - phpgroupware <unfixed> (embed)
86  all pythons          - egroupware <unfixed> (embed)
87  php4 (src included, but Debian package links dynamically)          - phpwiki (embed)
88  analog (src included, but Debian package links dynamically)          - php4 <unfixed> (embed)
89  libgoffice-1          TODO: check, php-pear, IIRC this was reorganized some weeks ago?
90  tf5 (since 5.0beta7 the Debian package links dynamically)  
91    shtool (affects build-time only)
92  tiff:          - mysql-ocaml <unfixed> (embed)
93  wxpythongtk (check, which debian pkg this is in)          - php4 <unfixed> (embed)
94  older kdegraphics/kpdf releases < 3.3 embedded a copy  
95    mozilla source code
96  uudeview:          - mozilla-firefox <unfixed> (embed)
97  libconvert-uulib-perl          - mozilla-thunderbird
98            - firefox <removed>
99  sqlite: (not affected by security vulnerabilities so far)          [etch] - firefox <unfixed> (embed)
100  amarok          - thunderbird <removed>
101            [etch] - thunderbird <unfixed> (embed)
102  util-linux/mount:          - iceweasel <unfixed> (embed)
103  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb          - iceape <unfixed> (embed)
104            - icedove <unfixed> (embed)
105  webmin:          - xulrunner <unfixed> (embed)
106  usermin (only in sarge)          - nvu <removed> (embed)
107    
108  sylpheed:  xli
109  sylpheed-claws          - xloadimage <unfixed> (embed)
110    
111  phpsysinfo:  lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
112  egroupware          - openmotif <unfixed> (embed)
113  phpgroupware          - xfree86/xorg <unfixed> (embed)
114            NOTE: in libxpm
115  phpldapadmin:  
116  egroupware (removed from egroupware after sarge)  kerberized apps with BSD origin
117            - krb4 <unfixed> (embed)
118  chmlib:          - krb5 <unfixed> (embed)
119  kchmviewer (not packaged in Debian)          - heimdal <unfixed> (embed)
120    
121  libavcodec/libavformat:  grip (which pkg is the origin?)
122  ffmpeg          - libcdaudio
123  xine-lib          - grip
124  xvidcap          - gnome-vfs
125  kino (links statically, does not include code)          TODO: check vfs2 as well
126  vlc (links statically, does not include code)  
127  smilutils (links statically, does not include code)  fudforum
128  motion (links statically, does not include code)          - phpgroupware-fudforum <unfixed> (embed)
129  gst-ffmpeg          - egroupware-fudforum <removed>
130  gstreamer0.10-ffmpeg          [sarge] - egroupware-fudforum <unfixed> (embed)
131  xmovie  
132    cvs
133  mad MPEG decoding lib:          - gcvs <unfixed> (embed)
134  mad          NOTE: see cvsunix/src in tarball
135  xine-lib  
136    pcre
137            - python* <unfixed> (embed)
138            - php4 <unknown> (embed)
139            - analog 2:5.23-0woody1 (embed)
140            - libgoffice-1 <unfixed> (embed)
141            - vfu 4.06-4.1 (embed; bug #450754)
142            - tf5 5.0beta7-1 (embed)
143            - monotone <unfixed> (embed)
144            NOTE: this only affects versions >= 0.37
145            - glib <unfixed> (embed)
146            NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic
147            - apache2 2.0.53-4 (embed)
148            - exim4 4.10-0.srh20.12 (embed)
149            - yacas <unfixed> (embed)
150            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
151            - gtamsanalyzer.app 0.42-5 (embed)
152    
153    tiff
154            - wxpythongtk <unfixed> (embed)
155            TODO: check, which debian pkg this is in
156    
157    uudeview
158            - libconvert-uulib-perl <unfixed> (embed)
159    
160    sqlite (not affected by security vulnerabilities so far)
161            - amarok <unfixed> (embed)
162            - monotone <unfixed> (embed)
163            - iceweasel <unfixed> (embed)
164    
165    util-linux/mount
166            - loop-aes-utils <unfixed> (embed)
167            NOTE: contains code from util-linux' mount in the mount-aes-udeb
168    
169    webmin
170            - usermin <unknown> (embed)
171            [sarge] - usermin <unfixed> (embed)
172    
173    sylpheed
174            - sylpheed-claws <unfixed> (fork)
175    
176    phpsysinfo
177            - egroupware <unfixed> (embed)
178            - phpgroupware <unfixed> (embed)
179    
180    phpldapadmin
181            [sarge] - egroupware <unfixed> (embed)
182            NOTE: removed from egroupware after sarge
183    
184    chmlib
185            - kchmviewer <unknown> (embed)
186    
187    libavcodec/libavformat (source: ffmpeg)
188            - mplayer <unfixed> (embed; bug #395252)
189            - xvidcap <unfixed> (embed)
190            - kino <unfixed> (static)
191            - vlc <unfixed> (static)
192            - smilutils <unfixed> (static)
193            - motion <unfixed> (static)
194            - gst-ffmpeg <unfixed> (embed)
195            - gstreamer0.10-ffmpeg <unfixed> (embed)
196            - xmovie <unfixed>
197            TODO: gimp-gap (potentially using ffmpeg code as well)
198    
199    mad MPEG decoding lib
200            - mad <unfixed> (embed)
201            - xine-lib <unfixed> (embed)
202    
 libdts:  
203  libdts  libdts
204  xine-lib          - xine-lib <unfixed> (embed)
205    
 flac:  
206  flac  flac
207  xine-lib          - xine-lib <unfixed> (embed)
208    
209    liba52
210            - a52dec <unfixed> (embed)
211            - xine-lib <unfixed> (embed)
212    
213    libmpeg2
214            - mpeg2dec <unfixed> (embed)
215            - xine-lib <unfixed> (embed)
216    
217    curl
218            - wget <unfixed> (embed)
219            NOTE: code for NTLM authentication
220    
221    uw-imap
222            - pine <unfixed> (embed)
223            - alpine <unfixed> (embed)
224    
225    imagemagick
226            - graphicsmagick <unfixed> (fork)
227    
228    halibut
229            - nsis <unfixed> (embed)
230    
231    libghttp
232            - hotway <unfixed> (embed)
233    
234    libsndfile
235            - ardour <unfixed> (embed)
236    
237  liba52:  glibmm2.4
238  a52dec          - ardour <unfixed> (embed)
 xine-lib  
239    
240  libmpeg2:  libgnomecanvasmm2.6
241  mpeg2dec          - ardour <unfixed> (embed)
 xine-lib  
242    
243  curl:  libsigc++-2.0
244  wget (code for NTLM authentication)          - ardour <unfixed> (embed)
245    
246  TODO evaluate:  soundtouch
247  gimp-gap (potentially using ffmpeg code as well)          - ardour <unfixed> (embed)
248    
249  uw-imap:  libmms
250  pine          - xine-lib <unfixed> (embed)
251            - mimms <unfixed> (embed)
252    
253  imagemagick:  fckeditor
254  graphicsmagick          - knowledgeroot <unfixed> (embed; bug #461555)
255            - moin <unfixed> (embed; bug #452599)
256            - karrigell <unfixed> (embed; bug #452598)
257            - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
258    
259  halibut:  ipatlas (not packaged in Debian)
260  nsis          - moodle <unfixed> (embed)
261    
262  libghttp:  libphp-phpmailer
263  hotway          - moodle <unfixed> (embed)
264    
265  etl-dev (will be renamed to libetl-dev soon):  htmlArea (not packaged in Debian)
266  synfig          - moodle <unfixed> (embed)
267    
268  libmms:  bennu (not packaged in Debian)
269  xine-lib          - moodle <unfixed> (embed)
 mimms  
270    
271  FCKeditor:  smarty:
272  knowledgeroot          - moodle <unfixed> (embed)
273    
 Moodle contains lots of things:  
 AdoDB  
 AdoDB-XML Schema  
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
274  TinyMCE  TinyMCE
275  bennu          - wordpress <unfixed> (embed)
276            - moodle <unfixed> (embed)
277            - knowledgeroot <unfixed> (embed)
278            - joomla <itp> (bug #326398)
279    
280    scintilla
281            - scite <unfixed> (embed)
282            - qscintilla <unfixed> (embed)
283            - qscintilla2 <unfixed> (embed)
284            - geany <unfixed> (embed)
285    
286    libphp-adodb
287            - moodle <unfixed> (embed)
288            NOTE: also AdoDB-XML Schema
289            - gallery2 <unfixed> (embed)
290            - phppgadmin <unfixed> (embed)
291            - egroupware <unfixed> (embed)
292            - phpwiki <unfixed> (embed)
293            - ipplan <unfixed> (embed)
294            - typo3 <unfixed> (embed)
295            - moodle <unfixed> (embed)
296            - cacti <unknown> (embed)
297            [sarge] - cacti <unfixed> (embed)
298            NOTE: dependency exists, but internal version is used
299    
300    gzip
301            - linux-kernel <unfixed> (embed)
302            NOTE: lib/inflate.c
303            - klibc <unfixed> (embed)
304            NOTE: based on linux-kernel gzip code
305            - busybox <unfixed> (embed)
306    
307    neon
308            - cadaver <unfixed> (embed; bug #188381)
309            - gnome-vfs2 <unfixed> (embed; bug #395874)
310            - litmus <unfixed> (embed; #395875)
311            [sarge] - screem <unfixed> (embed)
312            - sitecopy <unfixed> (embed; bug #395876)
313            [etch] - tla <unfixed> (embed; bug #395877)
314            [sarge] - tla <unfixed> (embed; bug #395877)
315    
316    libmodplug
317            - gst-plugins-bad0.10 <unfixed> (embed)
318    
319    libvncserver
320            - vino <unfixed> (embed)
321    
322    putty
323            - filezilla <unfixed> (embed)
324    
325    tinyxml (not packaged in Debian)
326            - filezilla <unfixed>
327    
328    gv
329            - evince <unfixed> (embed)
330            NOTE: ps/ tree from gv 3.5.8
331            - evince-gtk <unfixed> (embed)
332            NOTE: not packaged in Debian
333    
334    libXbae
335            [etch] - libpawlib2-lesstif <unfixed> (embed)
336            NOTE: from Cernlib
337    
338    libXaw
339            [etch] - libpawlib2-lesstif
340            NOTE: from Cernlib
341            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
342    
343    libgd2
344            - graphviz <unfixed> (embed)
345            NOTE: lib/gd seems to be 2.0.33
346    
347    rar
348            - unrar-nonfree <unfixed> (embed)
349    
350    unrar-free (maybe this code is derived from the original rar, too?)
351            - clamav <unfixed> (embed)
352            NOTE: seems to be disabled in default config
353    
354    mplayer (DirectMedia Object loader)
355            - xine-lib <unfixed> (embed)
356            NOTE: src/libw32dll/
357            - vlc <unfixed> (embed)
358            NOTE: modules/codec/dmo/
359    
360    libwpd (WordPerfect converter)
361            - openoffice.org <unfixed> (embed)
362    
363    fsplib (http://sourceforge.net/projects/fsp/)
364            - gftp <unfixed> (embed)
365            NOTE: lib/fsplib version 0.3
366    
367    librpcsecgss
368            - krb5 <unfixed> (embed)
369    
370    jasper
371            - ghostscript <unfixed> (embed)
372            - gs-gpl <unfixed> (embed)
373    
374    libidn
375            - monotone <unfixed> (embed)
376    
377    liblua
378            - monotone <unfixed> (embed)
379    
380    libbotan
381            - montone <unfixed> (embed)
382    
383    NetXX
384            - monotone <unfixed> (embed)
385    
386    libgc
387            - mono <unfixed> (embed)
388    
389    lzma
390            - p7zip <unfixed> (embed)
391    
392    lzo
393            - grub2 <unfixed> (embed)
394    
395    yassl
396            - mysql-dfsg-5.0 <unfixed> (embed)
397    
398    pax code
399            - tar <unfixed> (embed)
400            - cpio <unfixed> (embed)
401    
402    t1lib
403            - tetex-bin 2.0.2-1 (embed)
404            - texlive-bin <unknown> (embed)
405    
406    guichan
407            - boswars <unfixed> (embed)
408            NOTE: maintainer notified us, working on it
409    
410    tolua
411            - boswars <unfixed> (embed)
412            NOTE: maintainer notified us, working on it
413    
414    asio-dev
415            - luxrender <unfixed> (embed)
416            NOTE: maintainer notified us, working on it
417            NOTE: may be merged with boost "soon"
418    
 TinyMCE:  
 wordpress  
 moodle  
 knowledgeroot  
 joomla (ITP)  
   
 scintilla:  
 scite  
 qscintilla  
 geany  
   
 libphp-adodb:  
 gallery2  
 phppgadmin  
 egroupware  
 phpwiki  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
   
 gzip:  
 linux-kernel (lib/inflate.c)  
 klibc (based on linux-kernel gzip code)  
 busybox  
   
 ffmpeg:  
 mplayer (#395252)  
   
 neon:  
 cadaver (all, but being worked on: #188381)  
 gnome-vfs2 (#395874)  
 litmus (#395875)  
 screem (sarge only)  
 sitecopy (#395876)  
 tla (etch/sid only: #395877)  
   
 libmodplug:  
 gst-plugins-bad0.10  
   
 libvncserver:  
 vino  
   
 putty:  
 filezilla  
   
 tinyxml (not packaged in Debian):  
 filezilla  
   
 gv:  
 evince (ps/ tree from gv 3.5.8)  
 evince-gtk (not packaged in Debian)  
   
 libXbae:  
 libpawlib2-lesstif package (from Cernlib)  
   
 libXaw:  
 libpawlib2-lesstif package (from Cernlib)  
   
 (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  
   
 libgd2:  
 graphviz (lib/gd seems to be 2.0.33)  
   
 rar:  
 unrar-nonfree  
   
 unrar-free: (maybe this code is derived from the original rar, too?)  
 clamav (seems to be disabled in default config)  
   
 mplayer (DirectMedia Object loader):  
 xine-lib (src/libw32dll/)  
 vlc (modules/codec/dmo/)  
419    
 libwpd (WordPerfect converter):  
 openoffice.org  

Legend:
Removed from v.5564  
changed lines
  Added in v.7985

  ViewVC Help
Powered by ViewVC 1.1.5