/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 7055 by nion, Sun Oct 21 15:03:58 2007 UTC revision 8075 by stef-guest, Mon Feb 4 22:41:34 2008 UTC
# Line 1  Line 1 
1  This file collects cases, where a source package embeds code from  Embedded code copies
2  other projects, without linking dynamically:  ====================
   
 xpdf code: (some use xpdf 2, some xpdf 3)  
 gpdf (has been replaced by evince - which uses poppler - in Etch)  
 pdftohtml (has been replaced by poppler-utils from the poppler source package, still in Etch, though)  
 kdegraphics/kpdf (okular, the kpdf replacement in KDE 4 is using poppler, #436164)  
 tetex-bin (links to poppler since 3.0-12)  
 cupsys (uses xpdf-utils, it's still present in the src, though)  
 poppler  
 koffice/kword (upstream is working on using poppler, #436163)  
 libextractor (uses internal pdf decoder since 0.5.12-1)  
 pdfkit.framework (links to poppler since 0.8-4)  
 ipe (only small parts, but with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp)  
   
 silc-toolkit:  
 silc-client (uses libsilc and libsilcclient)  
   
 dietlibc:  
 ccontrol (links statically)  
   
 libiax:  
 iaxmodem  
   
 zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  
 dpkg  
 rsync (somehow derived code base)  
 mozilla(?)  
 Linux kernels  
 pvpgn (links dynamically since 1.7.8-2)  
 mrtg (links dynamically since 2.12.2-1)  
 rpm  
   
 libbz2:  
 dpkg (statically linked)  
   
 libgadu/ekg:  
 centericq  
 gaim  
 kopete (ships the code, but links dynamically in the Debian package)  
 kadu (not packaged in Debian)  
 GNU gadu (not yet packaged in Debian)  
   
 xmlrpc: (which package is the "origin" of this code?)  
 drupal  
 phpgroupware  
 egroupware  
 phpwiki  
 php4 (php-pear, IIRC this was reorganized some weeks ago?)  
 tikiwiki  
   
 shtool: (affects build-time only)  
 mysql-ocaml  
 php4  
   
 mozilla:  
 mozilla-firefox  
 mozilla-thunderbird  
 firefox (to be removed)  
 thunderbird (to be removed)  
 iceweasel  
 iceape  
 icedove  
 xulrunner  
 nvu (no longer in Debian)  
   
 xli:  
 xloadimage  
   
 lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)  
 openmotif  
 xfree86/xorg (in libxpm)  
   
 kerberized apps with BSD origin:  
 krb4  
 krb5  
 heimdal  
   
 grip: (which pkg is the origin?)  
 libcdaudio  
 grip  
 gnome-vfs (vfs2 as well?)  
   
 fudforum:  
 phpgroupware-fudforum  
 egroupware-fudforum (removed from egroupware after sarge)  
   
 cvs:  
 gcvs (at least an additional script is included, check if there's more)  
   
 pcre:  
 all pythons  
 php4 (src included, but Debian package links dynamically)  
 analog (src included, but Debian package links dynamically)  
 libgoffice-1  
 vfu  
 tf5 (since 5.0beta7 the Debian package links dynamically)  
 monotone  
   
 tiff:  
 wxpythongtk (check, which debian pkg this is in)  
 older kdegraphics/kpdf releases < 3.3 embedded a copy  
   
 uudeview:  
 libconvert-uulib-perl  
   
 sqlite: (not affected by security vulnerabilities so far)  
 amarok  
 monotone  
   
 util-linux/mount:  
 loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb  
   
 webmin:  
 usermin (only in sarge)  
   
 sylpheed:  
 sylpheed-claws  
   
 phpsysinfo:  
 egroupware  
 phpgroupware  
   
 phpldapadmin:  
 egroupware (removed from egroupware after sarge)  
   
 chmlib:  
 kchmviewer (not packaged in Debian)  
3    
4  libavcodec/libavformat:  This file collects cases, where a source package embeds code from
5  ffmpeg  other projects which is considered bad for fixing security flaws
6  xine-lib  because the fix needs to be applied in multiple source packages.
 xvidcap  
 kino (links statically, does not include code)  
 vlc (links statically, does not include code)  
 smilutils (links statically, does not include code)  
 motion (links statically, does not include code)  
 gst-ffmpeg  
 gstreamer0.10-ffmpeg  
 xmovie  
7    
8  mad MPEG decoding lib:  Format:
9  mad  <srcpkg> (<optional comment about srcpkg>)
10  xine-lib          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11            NOTE: optional comments about the linkage of the embedding srcpkg
12    
13    status: version number fixing the embedded copy, <unfixed>, <removed>, <itp> or <unknown> if the version number can not be determined
14    sort: static (linking statically against a lib)
15          embed (embedding a copy of the library into another source package)
16          fork (the package is not just embedding code but it is a fork and thus might share parts of the source code)
17    
18    The srcpkg might be some string to identify the code if there is no specific source package.
19    
20    Everything up to the next line is ignored
21    ---BEGIN
22    xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
23            NOTE: Fixed packages link to poppler library unless otherwise noted
24            - gpdf <removed>
25            [sarge] - gpdf <unfixed>
26            NOTE: has been replaced by evince in etch
27            - pdftohtml <unknown>
28            [sarge] - pdftohtml <unfixed>
29            [etch] - pdftohtml <unfixed>
30            NOTE: has been replaced by poppler-utils
31            - kdegraphics <unfixed> (embed; bug #436164)
32            NOTE: the kpdf replacement in KDE 4 is using poppler
33            - tetex-bin 3.0-12 (embed)
34            - texlive-bin 2007-1 (embed)
35            NOTE: links to poppler
36            - koffice <unfixed> (embed; bug #436163)
37            - libextractor 0.5.12-1 (embed)
38            NOTE: libextractor is using its own pdf decoder now
39            - libextractor 0.5.12-1 (embed)
40            - pdfkit.framework 0.8-4 (embed)
41            - ipe <unfixed> (embed)
42            NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
43            - ruby-gnome2 <unknown> (embed)
44            NOTE: copy only present in source but links to poppler
45    
46    ppmd
47            - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
48    
49    silc-toolkit
50            - silc-client 1.1~beta6-1 (embed)
51    
52    dietlibc
53            - ccontrol 0.9.1+20071204-1 (static)
54    
55    libiax
56            - iaxmodem <unfixed> (embed)
57    
58    zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
59            - dpkg <unfixed> (embed)
60            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
61            - rsync <unfixed> (embed)
62            NOTE: somehow derived code base
63            - mono <unfixed> (embed)
64            TODO: check mozilla
65            - Linux kernels <unfixed> (embed)
66            - pvpgn 1.7.8-2 (embed)
67            - mrtg 2.12.2-1 (embed)
68            - rpm <unknown> (embed)
69            NOTE: pinged anibal since when rpm was fixed
70    
71    libbz2
72            - dpkg <unfixed> (static)
73    
74    ekg
75            - centericq <unfixed> (embed)
76            - gaim <unfixed> (embed)
77            - pigdin <unfixed> (embed)(links dynamically against libgadu)
78            - kopete 4:3.3.2-5 (embed)
79            - kadu <unfixed> (embed)
80            - gadu <unfixed> (embed)
81            NOTE: g/kadu not packaged in Debian yet
82    
83    xmlrpc (which package is the "origin" of this code?)
84            - drupal <unfixed> (embed)
85            - phpgroupware <unfixed> (embed)
86            - egroupware <unfixed> (embed)
87            - phpwiki (embed)
88            - php4 <unfixed> (embed)
89            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
90    
91    shtool (affects build-time only)
92            - mysql-ocaml <unfixed> (embed)
93            - php4 <unfixed> (embed)
94    
95    mozilla source code
96            - mozilla-firefox <unfixed> (embed)
97            - mozilla-thunderbird
98            - firefox <removed>
99            [etch] - firefox <unfixed> (embed)
100            - thunderbird <removed>
101            [etch] - thunderbird <unfixed> (embed)
102            - iceweasel <unfixed> (embed)
103            - iceape <unfixed> (embed)
104            - icedove <unfixed> (embed)
105            - xulrunner <unfixed> (embed)
106            - nvu <removed> (embed)
107    
108    xli
109            - xloadimage <unfixed> (embed)
110    
111    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
112            - openmotif <unfixed> (embed)
113            - xfree86/xorg <unfixed> (embed)
114            NOTE: in libxpm
115    
116    kerberized apps with BSD origin
117            - krb4 <unfixed> (embed)
118            - krb5 <unfixed> (embed)
119            - heimdal <unfixed> (embed)
120    
121    grip (which pkg is the origin?)
122            - libcdaudio
123            - grip
124            - gnome-vfs
125            TODO: check vfs2 as well
126    
127    fudforum
128            - phpgroupware-fudforum <unfixed> (embed)
129            - egroupware-fudforum <removed>
130            [sarge] - egroupware-fudforum <unfixed> (embed)
131    
132    cvs
133            - gcvs <unfixed> (embed)
134            NOTE: see cvsunix/src in tarball
135    
136    pcre
137            - python* <unfixed> (embed)
138            - php4 <unknown> (embed)
139            - analog 2:5.23-0woody1 (embed)
140            - libgoffice-1 <unfixed> (embed)
141            - vfu 4.06-4.1 (embed; bug #450754)
142            - tf5 5.0beta7-1 (embed)
143            - monotone <unfixed> (embed)
144            NOTE: this only affects versions >= 0.37
145            - glib <unfixed> (embed)
146            NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic
147            - apache2 2.0.53-4 (embed)
148            - exim4 4.10-0.srh20.12 (embed)
149            - yacas <unfixed> (embed)
150            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
151            - gtamsanalyzer.app 0.42-5 (embed)
152    
153    tiff
154            - wxpythongtk <unfixed> (embed)
155            TODO: check, which debian pkg this is in
156    
157    uudeview
158            - libconvert-uulib-perl <unfixed> (embed)
159    
160    sqlite (not affected by security vulnerabilities so far)
161            - amarok <unfixed> (embed)
162            - monotone <unfixed> (embed)
163            - iceweasel <unfixed> (embed)
164    
165    util-linux/mount
166            - loop-aes-utils <unfixed> (embed)
167            NOTE: contains code from util-linux' mount in the mount-aes-udeb
168    
169    webmin
170            - usermin <unknown> (embed)
171            [sarge] - usermin <unfixed> (embed)
172    
173    sylpheed
174            - sylpheed-claws <unfixed> (fork)
175    
176    phpsysinfo
177            - egroupware <unfixed> (embed)
178            - phpgroupware <unfixed> (embed)
179    
180    phpldapadmin
181            [sarge] - egroupware <unfixed> (embed)
182            NOTE: removed from egroupware after sarge
183    
184    chmlib
185            - kchmviewer <unknown> (embed)
186    
187    libavcodec/libavformat (source: ffmpeg)
188            - mplayer <unfixed> (embed; bug #395252)
189            - xvidcap <unfixed> (embed)
190            - kino <unfixed> (static)
191            - vlc <unfixed> (static)
192            - smilutils <unfixed> (static)
193            - motion <unfixed> (static)
194            - gst-ffmpeg <unfixed> (embed)
195            - gstreamer0.10-ffmpeg <unfixed> (embed)
196            - xmovie <unfixed>
197            TODO: gimp-gap (potentially using ffmpeg code as well)
198    
199    mad MPEG decoding lib
200            - mad <unfixed> (embed)
201            - xine-lib <unfixed> (embed)
202    
 libdts:  
203  libdts  libdts
204  xine-lib          - xine-lib <unfixed> (embed)
205    
 flac:  
206  flac  flac
207  xine-lib          - xine-lib <unfixed> (embed)
   
 liba52:  
 a52dec  
 xine-lib  
   
 libmpeg2:  
 mpeg2dec  
 xine-lib  
208    
209  curl:  liba52
210  wget (code for NTLM authentication)          - a52dec <unfixed> (embed)
211            - xine-lib <unfixed> (embed)
212    
213  TODO evaluate:  libmpeg2
214  gimp-gap (potentially using ffmpeg code as well)          - mpeg2dec <unfixed> (embed)
215            - xine-lib <unfixed> (embed)
216    
217  uw-imap:  curl
218  pine          - wget <unfixed> (embed)
219  alpine          NOTE: code for NTLM authentication
220    
221  imagemagick:  uw-imap
222  graphicsmagick          - pine <unfixed> (embed)
223            - alpine <unfixed> (embed)
224    
225  halibut:  imagemagick
226  nsis          - graphicsmagick <unfixed> (fork)
227    
228  libghttp:  halibut
229  hotway          - nsis <unfixed> (embed)
230    
231  libsndfile:  libghttp
232  ardour          - hotway <unfixed> (embed)
233    
234  glibmm2.4:  libsndfile
235  ardour          - ardour <unfixed> (embed)
236    
237  libgnomecanvasmm2.6:  glibmm2.4
238  ardour          - ardour <unfixed> (embed)
239    
240  libsigc++-2.0:  libgnomecanvasmm2.6
241  ardour          - ardour <unfixed> (embed)
242    
243  soundtouch:  libsigc++-2.0
244  ardour          - ardour <unfixed> (embed)
245    
246  libmms:  soundtouch
247  xine-lib          - ardour <unfixed> (embed)
 mimms  
   
 FCKeditor:  
 knowledgeroot  
 moin  
 karrigell  
 gforge-plugins-extra  
   
 Moodle contains lots of things:  
 AdoDB  
 AdoDB-XML Schema  
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
 TinyMCE  
 bennu  
248    
249  TinyMCE:  libmms
250  wordpress          - xine-lib <unfixed> (embed)
251  moodle          - mimms <unfixed> (embed)
 knowledgeroot  
 joomla (ITP)  
252    
253  scintilla:  fckeditor
254  scite          - knowledgeroot <unfixed> (embed; bug #461555)
255  qscintilla          - moin <unfixed> (embed; bug #452599)
256  geany          - karrigell <unfixed> (embed; bug #452598)
257            - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
258    
259  libphp-adodb:  ipatlas (not packaged in Debian)
260  gallery2          - moodle <unfixed> (embed)
 phppgadmin  
 egroupware  
 phpwiki  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
261    
262  gzip:  libphp-phpmailer
263  linux-kernel (lib/inflate.c)          - moodle <unfixed> (embed)
 klibc (based on linux-kernel gzip code)  
 busybox  
264    
265  ffmpeg:  htmlArea (not packaged in Debian)
266  mplayer (#395252)          - moodle <unfixed> (embed)
267    
268  neon:  bennu (not packaged in Debian)
269  cadaver (all, but being worked on: #188381)          - moodle <unfixed> (embed)
 gnome-vfs2 (#395874)  
 litmus (#395875)  
 screem (sarge only)  
 sitecopy (#395876)  
 tla (etch/sid only: #395877)  
270    
271  libmodplug:  smarty:
272  gst-plugins-bad0.10          - moodle <unfixed> (embed)
273    
274  libvncserver:  TinyMCE
275  vino          - wordpress <unfixed> (embed)
276            - moodle <unfixed> (embed)
277            - knowledgeroot <unfixed> (embed)
278            - joomla <itp> (bug #326398)
279    
280    scintilla
281            - scite <unfixed> (embed)
282            - qscintilla <unfixed> (embed)
283            - qscintilla2 <unfixed> (embed)
284            - geany <unfixed> (embed)
285    
286    libphp-adodb
287            - moodle <unfixed> (embed)
288            NOTE: also AdoDB-XML Schema
289            - gallery2 <unfixed> (embed)
290            - phppgadmin <unfixed> (embed)
291            - egroupware <unfixed> (embed)
292            - phpwiki <unfixed> (embed)
293            - ipplan <unfixed> (embed)
294            - typo3 <unfixed> (embed)
295            - moodle <unfixed> (embed)
296            - cacti <unknown> (embed)
297            [sarge] - cacti <unfixed> (embed)
298            NOTE: dependency exists, but internal version is used
299    
300    gzip
301            - linux-kernel <unfixed> (embed)
302            NOTE: lib/inflate.c
303            - klibc <unfixed> (embed)
304            NOTE: based on linux-kernel gzip code
305            - busybox <unfixed> (embed)
306    
307    neon
308            - cadaver <unfixed> (embed; bug #188381)
309            - gnome-vfs2 <unfixed> (embed; bug #395874)
310            - litmus <unfixed> (embed; #395875)
311            [sarge] - screem <unfixed> (embed)
312            - sitecopy <unfixed> (embed; bug #395876)
313            [etch] - tla <unfixed> (embed; bug #395877)
314            [sarge] - tla <unfixed> (embed; bug #395877)
315    
316    libmodplug
317            - gst-plugins-bad0.10 <unfixed> (embed)
318    
319    libvncserver
320            - vino <unfixed> (embed)
321    
322    putty
323            - filezilla <unfixed> (embed)
324    
325    tinyxml (not packaged in Debian)
326            - filezilla <unfixed>
327    
328    gv
329            - evince <unfixed> (embed)
330            NOTE: ps/ tree from gv 3.5.8
331            - evince-gtk <unfixed> (embed)
332            NOTE: not packaged in Debian
333    
334    libXbae
335            [etch] - libpawlib2-lesstif <unfixed> (embed)
336            NOTE: from Cernlib
337    
338    libXaw
339            [etch] - libpawlib2-lesstif
340            NOTE: from Cernlib
341            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
342    
343    libgd2
344            - graphviz <unfixed> (embed)
345            NOTE: lib/gd seems to be 2.0.33
346    
347    rar
348            - unrar-nonfree <unfixed> (embed)
349    
350    unrar-free (maybe this code is derived from the original rar, too?)
351            - clamav <unfixed> (embed)
352            NOTE: seems to be disabled in default config
353    
354    mplayer (DirectMedia Object loader)
355            - xine-lib <unfixed> (embed)
356            NOTE: src/libw32dll/
357            - vlc <unfixed> (embed)
358            NOTE: modules/codec/dmo/
359    
360    libwpd (WordPerfect converter)
361            - openoffice.org <unfixed> (embed)
362    
363    fsplib (http://sourceforge.net/projects/fsp/)
364            - gftp <unfixed> (embed)
365            NOTE: lib/fsplib version 0.3
366    
367    librpcsecgss
368            - krb5 <unfixed> (embed)
369    
370    jasper
371            - ghostscript <unfixed> (embed)
372            - gs-gpl <unfixed> (embed)
373    
374  putty:  libidn
375  filezilla          - monotone <unfixed> (embed)
376    
377  tinyxml (not packaged in Debian):  liblua
378  filezilla          - monotone <unfixed> (embed)
379    
380  gv:  libbotan
381  evince (ps/ tree from gv 3.5.8)          - montone <unfixed> (embed)
 evince-gtk (not packaged in Debian)  
382    
383  libXbae:  NetXX
384  libpawlib2-lesstif package (from Cernlib)          - monotone <unfixed> (embed)
385    
386  libXaw:  libgc
387  libpawlib2-lesstif package (from Cernlib)          - mono <unfixed> (embed)
388    
389  (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  lzma
390            - p7zip <unfixed> (embed)
391    
392  libgd2:  lzo
393  graphviz (lib/gd seems to be 2.0.33)          - grub2 <unfixed> (embed)
394    
395  rar:  yassl
396  unrar-nonfree          - mysql-dfsg-5.0 <unfixed> (embed)
397    
398  unrar-free: (maybe this code is derived from the original rar, too?)  pax code
399  clamav (seems to be disabled in default config)          - tar <unfixed> (embed)
400            - cpio <unfixed> (embed)
401    
402  mplayer (DirectMedia Object loader):  t1lib
403  xine-lib (src/libw32dll/)          - tetex-bin 2.0.2-1 (embed)
404  vlc (modules/codec/dmo/)          - texlive-bin <unknown> (embed)
405    
406  libwpd (WordPerfect converter):  guichan
407  openoffice.org          - boswars <unfixed> (embed)
408            NOTE: maintainer notified us, working on it
409    
410  fsplib (http://sourceforge.net/projects/fsp/):  tolua
411  gftp (lib/fsplib version 0.3)          - boswars <unfixed> (embed)
412            NOTE: maintainer notified us, working on it
413    
414  librpcsecgss:  asio-dev
415  krb5          - luxrender <unfixed> (embed)
416            NOTE: maintainer notified us, working on it
417            NOTE: may be merged with boost "soon"
418    
419  jasper:  xine-lib
420  ghostscript          - vlc <unfixed> (embed)
421  gs-gpl          NOTE: only parts included in modules/access/rtsp
422    
423  monotone embeds lots of things:  netpbm
424  liblua          - tcl8.3 <unfixed> (embed)
425  libidn          - tcl8.4 <unfixed> (embed)
426  libsqlite3          - tcl8.5 <unfixed> (embed)
427  libbotan          NOTE: generic/tkImgGIF.c
 NetXX  
 pcre (starting from 0.37)  

Legend:
Removed from v.7055  
changed lines
  Added in v.8075

  ViewVC Help
Powered by ViewVC 1.1.5