/[secure-testing]/data/embedded-code-copies

Diff of /data/embedded-code-copies

Parent Directory | Revision Log | View Patch Patch

-revision 8075 by stef-guest,
Mon Feb  4 22:41:34 2008 UTC
+revision 8780 by nion,
Mon May 12 13:08:46 2008 UTC
 Line 1
  Embedded code copies
  ====================
- This file collects cases, where a source package embeds code from
+ This file collects source packages that embed code from other projects.
- other projects which is considered bad for fixing security flaws
+ This is considered bad for fixing security flaws because the fix needs
- because the fix needs to be applied in multiple source packages.
+ to be applied in multiple source packages.
  Format:
  <srcpkg> (<optional comment about srcpkg>)
          - <embedding srcpkg> <status> (<sort>; bug #<number>)
          NOTE: optional comments about the linkage of the embedding srcpkg
- status: version number fixing the embedded copy, <unfixed>, <removed>, <itp> or <unknown> if the version number can not be determined
+ status: version number fixing the embedded copy, <unfixed>, <removed>,
+         <itp> or <unknown> if the version number can not be determined
+         <unfixable> for unavoidable cases (e.g., forks that add real value)
  sort: static (linking statically against a lib)
        embed (embedding a copy of the library into another source package)
-       fork (the package is not just embedding code but it is a fork and thus might share parts of the source code)
+       fork (the package is not just embedding code but it is a fork and
+             thus might share parts of the source code)
+       old-version (the package is an older version of essentially
+                    the same code)
- The srcpkg might be some string to identify the code if there is no specific source package.
+ The srcpkg might be some string to identify the code if there is no
+ specific source package.
- Everything up to the next line is ignored
+ Everything up to the next line is ignored.
  ---BEGIN
  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
          NOTE: Fixed packages link to poppler library unless otherwise noted
-Line 30 
 xpdf (some srcpkgs use xpdf2 code, some
+Line 36 
 xpdf (some srcpkgs use xpdf2 code, some
          NOTE: has been replaced by poppler-utils
          - kdegraphics <unfixed> (embed; bug #436164)
          NOTE: the kpdf replacement in KDE 4 is using poppler
-         - tetex-bin 3.0-12 (embed)
+         - texlive-base 3.0-12 (embed)
          - texlive-bin 2007-1 (embed)
          NOTE: links to poppler
          - koffice <unfixed> (embed; bug #436163)
-Line 46 
 xpdf (some srcpkgs use xpdf2 code, some
+Line 52 
 xpdf (some srcpkgs use xpdf2 code, some
  ppmd
          - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
+ peercast
+         - gnome-peercast <unfixed> (embed)
+         NOTE: gnome-peercast may better be removed, see #466539
  silc-toolkit
          - silc-client 1.1~beta6-1 (embed)
-Line 149 
 pcre
+Line 159 
 pcre
          - yacas <unfixed> (embed)
          NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
          - gtamsanalyzer.app 0.42-5 (embed)
+         - tin <unknown> (embed)
+         - kazehakase 0.5.2-1
+         - webkit <unfixed> (embed)
+         - qt4-x11 <unfixed> (embed)
+         NOTE: embedded via webkit copy
  tiff
-         - wxpythongtk <unfixed> (embed)
+         - wxwindows2.4 2.2.1 (embed)
-         TODO: check, which debian pkg this is in
  uudeview
          - libconvert-uulib-perl <unfixed> (embed)
-Line 251 
 libmms
+Line 265 
 libmms
          - mimms <unfixed> (embed)
  fckeditor
-         - knowledgeroot <unfixed> (embed; bug #461555)
+         - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
          - moin <unfixed> (embed; bug #452599)
          - karrigell <unfixed> (embed; bug #452598)
          - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
-Line 265 
 libphp-phpmailer
+Line 279 
 libphp-phpmailer
  htmlArea (not packaged in Debian)
          - moodle <unfixed> (embed)
+ giflib:
+         - wine <unfixed> (embed; bug #466181)
  bennu (not packaged in Debian)
          - moodle <unfixed> (embed)
  smarty:
-         - moodle <unfixed> (embed)
+         - moodle <unfixed> (embed; bug #471158)
+         - gallery2 <unfixed> (embed; bug #471160)
+         - mahara 0.9.2-2 (embed; bug #471201)
+         - gosa 2.4beta1-1 (embed; bug #471200)
  TinyMCE
-         - wordpress <unfixed> (embed)
+         - wordpress <unfixed> (embed; bug #478257)
          - moodle <unfixed> (embed)
          - knowledgeroot <unfixed> (embed)
          - joomla <itp> (bug #326398)
-Line 343 
 libXaw
+Line 363 
 libXaw
  libgd2
          - graphviz <unfixed> (embed)
          NOTE: lib/gd seems to be 2.0.33
+         - wml <unfixed> (embed)
+         NOTE: derived from gd 1.6.3
  rar
          - unrar-nonfree <unfixed> (embed)
-Line 425 
 netpbm
+Line 447 
 netpbm
          - tcl8.4 <unfixed> (embed)
          - tcl8.5 <unfixed> (embed)
          NOTE: generic/tkImgGIF.c
+ tk8.5
+         - tk8.0 <removed> (old-version)
+         - tk8.3 <unfixed> (old-version)
+         - tk8.4 <unfixed> (old-version)
+         - perl-tk <unfixable> (fork)
+ samba
+         - mc <unfixed> (embed)
+         NOTE: maintainer is aware of this, currently searching a solution
+ plib1.8.4c2
+         - boson <unfixed> (fork)
+         NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
+ fribidi
+         - quesoglc <unfixed> (embed)
+ glew
+         - quesoglc <unfixed> (embed)
+ minorGems
+         - transcend <unfixed> (embed)
+         - cultivation <unfixed> (embed)
+ tar
+         - libarchive <unfixed> (embed)
+         NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
+ cpio
+         - libarchive <unfixed> (embed)
+         NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
+ webkit
+         - qt4-x11 <unfixed> (embed)
+ ftgl
+         - blender 2.45+r14660-1 (embed)
+         NOTE: Once the above version is released, it will be fixed
+ wv
+         - abiword <unfixed>
+ qemu
+         - kvm <unfixed> (embed)
+ speex
+         - vorbis-tools <unfixed> (embed)
+         NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
+         - gst-plugins-good0.10 <unfixed> (embed)
+         - xine-lib <unfixed> (embed)
+         - libfishsound <unfixed> (embed)
+         - libannodex <unfixed> (embed)
+         - vlc <unfixed> (embed)
+         - xmms-speex <unfixed> (embed)
+         - libsdl-sound1.2 <unfixed> (embed)
+         - sweep <unfixed> (embed)
+ libreadline
+         - magic <unfixed> (old-version)
+         NOTE: magic is currently an RFS
+ opcode
+         - ode <unfixed> (embed)
+         NOTE: opcode is not a package in debian, it is just embedded
+         NOTE: http://www.codercorner.com/Opcode.htm
+ gimpact
+         - ode <unfixed> (embed)
+         NOTE: gimpact is not a package in debian, it is just embedded
+         NOTE: http://gimpact.sf.net
+ MochiKit.js
+         - mahara <unfixed> (embed)
+         - ntop <unfixed> (embed)
+         - python-oherence <unfixed> (embed)
+         - python-paste <unfixed> (embed)
+         - python-turbogears <unfixed> (embed)
+         - zope-plone3 <unfixed> (embed)
+ prototype.js
+         - netbeans-ide <unfixed> (embed)
+         - auth2db-frontend <unfixed> (embed)
+         - citadel-webcit <unfixed> (embed)
+         - asterisk <unfixed> (embed)
+         - doc-iana <unfixed> (embed)
+         - libaws-doc <unfixed> (embed)
+         - libgettext-ruby-data <unfixed> (embed)
+         - libjson-ruby-doc <unfixed> (embed)
+         - liblucene2-java-doc <unfixed> (embed)
+         - libopenid-ruby <unfixed> (embed)
+         - solr-common <unfixed> (embed)
+         - glpi <unfixed> (embed)
+         - hobbix <unfixed> (embed)
+         - mnemo2 <unfixed> (embed)
+         - nag2 <unfixed> (embed)
+         - libjs-prototype <unfixed> (embed)
+         - libjs-scriptaculous <unfixed> (embed)
+         - knowledgeroot <unfixed> (embed)
+         - mediatomb-common <unfixed> (embed)
+         - mt-daapd <unfixed> (embed)
+         - op-panel <unfixed> (embed)
+         - ebug-http <unfixed> (embed)
+         - phpgedview <unfixed> (embed)
+         - poker-web <unfixed> (embed)
+         - python-webhelpers <unfixed> (embed)
+         - qwik <unfixed> (embed)
+         - rails <unfixed> (embed)
+         - typo3-src-4.1 <unfixed> (embed)
+         - wordpress <unfixed> (embed)
+         - zope-plone3 <unfixed> (embed)
+         - smokeping <unfixed> (embed)

 Legend:



Removed from v.8075
 


changed lines


 
Added in v.8780
 Legend:



Removed from v.8075
 


changed lines


 
Added in v.8780
-Removed from v.8075
+Added in v.8780

	ViewVC Help
Powered by ViewVC 1.1.5