/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 5440 by stef-guest, Sun Feb 11 21:08:25 2007 UTC revision 8175 by nion, Sun Feb 17 13:31:09 2008 UTC
# Line 1  Line 1 
1  This file collects cases, where a source package embeds code from  Embedded code copies
2  other projects, without linking dynamically:  ====================
3    
4  xpdf code: (some use xpdf 2, some xpdf 3)  This file collects source packages that embed code from other projects.
5  gpdf (will be replaced by evince in Gnome 2.12)  This is considered bad for fixing security flaws because the fix needs
6  pdftohtml (current poppler source package has a ported version, pinged maintainer)  to be applied in multiple source packages.
7  kdegraphics/kpdf (upstream is working on using poppler, probably not in time for Etch)  
8  tetex-bin (links to poppler since 3.0-12)  Format:
9  cupsys (only older releases, recent ones use xpdf-utils, it's still present in the src, though)  <srcpkg> (<optional comment about srcpkg>)
10  poppler          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11  koffice/kword (upstream is working on using poppler, probably not in time for Etch)          NOTE: optional comments about the linkage of the embedding srcpkg
12  libextractor (uses internal pdf decoder since 0.5.12-1)  
13  pdfkit.framework (links to poppler since 0.8-4)  status: version number fixing the embedded copy, <unfixed>, <removed>,
14            <itp> or <unknown> if the version number can not be determined
15  zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)          <unfixable> for unavoidable cases (e.g., forks that add real value)
16  dpkg  sort: static (linking statically against a lib)
17  rsync (somehow derived code base)        embed (embedding a copy of the library into another source package)
18  mozilla(?)        fork (the package is not just embedding code but it is a fork and
19  Linux kernels              thus might share parts of the source code)
20  pvpgn (links dynamically since 1.7.8-2)        old-version (the package is an older version of essentially
21  mrtg (links dynamically since 2.12.2-1)                     the same code)
22  rpm  
23    The srcpkg might be some string to identify the code if there is no
24  libbz2:  specific source package.
25  dpkg (statically linked)  
26    Everything up to the next line is ignored.
27  libgadu/ekg:  ---BEGIN
28  centericq  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29  gaim          NOTE: Fixed packages link to poppler library unless otherwise noted
30  kopete (ships the code, but links dynamically in the Debian package)          - gpdf <removed>
31  kadu (not packaged in Debian)          [sarge] - gpdf <unfixed>
32  GNU gadu (not yet packaged in Debian)          NOTE: has been replaced by evince in etch
33            - pdftohtml <unknown>
34  xmlrpc: (which package is the "origin" of this code?)          [sarge] - pdftohtml <unfixed>
35  drupal          [etch] - pdftohtml <unfixed>
36  phpgroupware          NOTE: has been replaced by poppler-utils
37  egroupware          - kdegraphics <unfixed> (embed; bug #436164)
38  phpwiki          NOTE: the kpdf replacement in KDE 4 is using poppler
39  php4 (php-pear, IIRC this was reorganized some weeks ago?)          - tetex-bin 3.0-12 (embed)
40  tikiwiki          - texlive-bin 2007-1 (embed)
41            NOTE: links to poppler
42  shtool: (affects build-time only)          - koffice <unfixed> (embed; bug #436163)
43  mysql-ocaml          - libextractor 0.5.12-1 (embed)
44  php4          NOTE: libextractor is using its own pdf decoder now
45            - libextractor 0.5.12-1 (embed)
46  mozilla:          - pdfkit.framework 0.8-4 (embed)
47  mozilla-firefox          - ipe <unfixed> (embed)
48  mozilla-thunderbird          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
49  firefox (to be removed)          - ruby-gnome2 <unknown> (embed)
50  thunderbird (to be removed)          NOTE: copy only present in source but links to poppler
51  iceweasel  
52  iceape  ppmd
53  icedove          - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
54  xulrunner  
55  nvu (no longer in Debian)  silc-toolkit
56            - silc-client 1.1~beta6-1 (embed)
57  xli:  
58  xloadimage  dietlibc
59            - ccontrol 0.9.1+20071204-1 (static)
60  lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)  
61  openmotif  libiax
62  xfree86/xorg (in libxpm)          - iaxmodem <unfixed> (embed)
63    
64  kerberized apps with BSD origin:  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
65  krb4          - dpkg <unfixed> (embed)
66  krb5          NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
67  heimdal          - rsync <unfixed> (embed)
68            NOTE: somehow derived code base
69  grip: (which pkg is the origin?)          - mono <unfixed> (embed)
70  libcdaudio          TODO: check mozilla
71  grip          - Linux kernels <unfixed> (embed)
72  gnome-vfs (vfs2 as well?)          - pvpgn 1.7.8-2 (embed)
73            - mrtg 2.12.2-1 (embed)
74  fudforum:          - rpm <unknown> (embed)
75  phpgroupware-fudforum          NOTE: pinged anibal since when rpm was fixed
76  egroupware-fudforum (removed from egroupware after sarge)  
77    libbz2
78  cvs:          - dpkg <unfixed> (static)
79  gcvs (at least an additional script is included, check if there's more)  
80    ekg
81  pcre:          - centericq <unfixed> (embed)
82  all pythons          - gaim <unfixed> (embed)
83  php4 (src included, but Debian package links dynamically)          - pigdin <unfixed> (embed)(links dynamically against libgadu)
84  analog (src included, but Debian package links dynamically)          - kopete 4:3.3.2-5 (embed)
85  libgoffice-1          - kadu <unfixed> (embed)
86  tf5 (since 5.0beta7 the Debian package links dynamically)          - gadu <unfixed> (embed)
87            NOTE: g/kadu not packaged in Debian yet
88  tiff:  
89  wxpythongtk (check, which debian pkg this is in)  xmlrpc (which package is the "origin" of this code?)
90  older kdegraphics/kpdf releases < 3.3 embedded a copy          - drupal <unfixed> (embed)
91            - phpgroupware <unfixed> (embed)
92  uudeview:          - egroupware <unfixed> (embed)
93  libconvert-uulib-perl          - phpwiki (embed)
94            - php4 <unfixed> (embed)
95  sqlite: (not affected by security vulnerabilities so far)          TODO: check, php-pear, IIRC this was reorganized some weeks ago?
96  amarok  
97    shtool (affects build-time only)
98  util-linux/mount:          - mysql-ocaml <unfixed> (embed)
99  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb          - php4 <unfixed> (embed)
100    
101  webmin:  mozilla source code
102  usermin (only in sarge)          - mozilla-firefox <unfixed> (embed)
103            - mozilla-thunderbird
104  sylpheed:          - firefox <removed>
105  sylpheed-claws          [etch] - firefox <unfixed> (embed)
106            - thunderbird <removed>
107  phpsysinfo:          [etch] - thunderbird <unfixed> (embed)
108  egroupware          - iceweasel <unfixed> (embed)
109  phpgroupware          - iceape <unfixed> (embed)
110            - icedove <unfixed> (embed)
111            - xulrunner <unfixed> (embed)
112            - nvu <removed> (embed)
113    
114    xli
115            - xloadimage <unfixed> (embed)
116    
117    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
118            - openmotif <unfixed> (embed)
119            - xfree86/xorg <unfixed> (embed)
120            NOTE: in libxpm
121    
122    kerberized apps with BSD origin
123            - krb4 <unfixed> (embed)
124            - krb5 <unfixed> (embed)
125            - heimdal <unfixed> (embed)
126    
127    grip (which pkg is the origin?)
128            - libcdaudio
129            - grip
130            - gnome-vfs
131            TODO: check vfs2 as well
132    
133    fudforum
134            - phpgroupware-fudforum <unfixed> (embed)
135            - egroupware-fudforum <removed>
136            [sarge] - egroupware-fudforum <unfixed> (embed)
137    
138    cvs
139            - gcvs <unfixed> (embed)
140            NOTE: see cvsunix/src in tarball
141    
142    pcre
143            - python* <unfixed> (embed)
144            - php4 <unknown> (embed)
145            - analog 2:5.23-0woody1 (embed)
146            - libgoffice-1 <unfixed> (embed)
147            - vfu 4.06-4.1 (embed; bug #450754)
148            - tf5 5.0beta7-1 (embed)
149            - monotone <unfixed> (embed)
150            NOTE: this only affects versions >= 0.37
151            - glib <unfixed> (embed)
152            NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic
153            - apache2 2.0.53-4 (embed)
154            - exim4 4.10-0.srh20.12 (embed)
155            - yacas <unfixed> (embed)
156            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
157            - gtamsanalyzer.app 0.42-5 (embed)
158    
159    tiff
160            - wxpythongtk <unfixed> (embed)
161            TODO: check, which debian pkg this is in
162    
163    uudeview
164            - libconvert-uulib-perl <unfixed> (embed)
165    
166    sqlite (not affected by security vulnerabilities so far)
167            - amarok <unfixed> (embed)
168            - monotone <unfixed> (embed)
169            - iceweasel <unfixed> (embed)
170    
171    util-linux/mount
172            - loop-aes-utils <unfixed> (embed)
173            NOTE: contains code from util-linux' mount in the mount-aes-udeb
174    
175    webmin
176            - usermin <unknown> (embed)
177            [sarge] - usermin <unfixed> (embed)
178    
179    sylpheed
180            - sylpheed-claws <unfixed> (fork)
181    
182    phpsysinfo
183            - egroupware <unfixed> (embed)
184            - phpgroupware <unfixed> (embed)
185    
186    phpldapadmin
187            [sarge] - egroupware <unfixed> (embed)
188            NOTE: removed from egroupware after sarge
189    
190    chmlib
191            - kchmviewer <unknown> (embed)
192    
193    libavcodec/libavformat (source: ffmpeg)
194            - mplayer <unfixed> (embed; bug #395252)
195            - xvidcap <unfixed> (embed)
196            - kino <unfixed> (static)
197            - vlc <unfixed> (static)
198            - smilutils <unfixed> (static)
199            - motion <unfixed> (static)
200            - gst-ffmpeg <unfixed> (embed)
201            - gstreamer0.10-ffmpeg <unfixed> (embed)
202            - xmovie <unfixed>
203            TODO: gimp-gap (potentially using ffmpeg code as well)
204    
205    mad MPEG decoding lib
206            - mad <unfixed> (embed)
207            - xine-lib <unfixed> (embed)
208    
209  phpldapadmin:  libdts
210  egroupware (removed from egroupware after sarge)          - xine-lib <unfixed> (embed)
211    
212  chmlib:  flac
213  kchmviewer (not packaged in Debian)          - xine-lib <unfixed> (embed)
214    
215  libavcodec/libavformat:  liba52
216  ffmpeg          - a52dec <unfixed> (embed)
217  xine-lib          - xine-lib <unfixed> (embed)
 xvidcap  
 kino (links statically, does not include code)  
 vlc (links statically, does not include code)  
 smilutils (links statically, does not include code)  
 motion (links statically, does not include code)  
 gst-ffmpeg  
 gstreamer0.10-ffmpeg  
 xmovie  
218    
219  mad MPEG decoding lib:  libmpeg2
220  mad          - mpeg2dec <unfixed> (embed)
221  xine-lib          - xine-lib <unfixed> (embed)
222    
223  libdts:  curl
224  libdts          - wget <unfixed> (embed)
225  xine-lib          NOTE: code for NTLM authentication
226    
227  flac:  uw-imap
228  flac          - pine <unfixed> (embed)
229  xine-lib          - alpine <unfixed> (embed)
230    
231  liba52:  imagemagick
232  a52dec          - graphicsmagick <unfixed> (fork)
 xine-lib  
233    
234  libmpeg2:  halibut
235  mpeg2dec          - nsis <unfixed> (embed)
 xine-lib  
236    
237  curl:  libghttp
238  wget (code for NTLM authentication)          - hotway <unfixed> (embed)
239    
240  TODO evaluate:  libsndfile
241  gimp-gap (potentially using ffmpeg code as well)          - ardour <unfixed> (embed)
242    
243  uw-imap:  glibmm2.4
244  pine          - ardour <unfixed> (embed)
245    
246  imagemagick:  libgnomecanvasmm2.6
247  graphicsmagick          - ardour <unfixed> (embed)
248    
249  halibut:  libsigc++-2.0
250  nsis          - ardour <unfixed> (embed)
251    
252  libghttp:  soundtouch
253  hotway          - ardour <unfixed> (embed)
254    
255  etl-dev (will be renamed to libetl-dev soon):  libmms
256  synfig          - xine-lib <unfixed> (embed)
257            - mimms <unfixed> (embed)
258    
259  libmms:  fckeditor
260  xine-lib          - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
261  mimms          - moin <unfixed> (embed; bug #452599)
262            - karrigell <unfixed> (embed; bug #452598)
263            - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
264    
265  FCKeditor:  ipatlas (not packaged in Debian)
266  knowledgeroot          - moodle <unfixed> (embed)
267    
268  Moodle contains lots of things:  libphp-phpmailer
269  AdoDB          - moodle <unfixed> (embed)
 AdoDB-XML Schema  
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
 TinyMCE  
 bennu  
270    
271  TinyMCE:  htmlArea (not packaged in Debian)
272  wordpress          - moodle <unfixed> (embed)
 moodle  
 knowledgeroot  
 joomla (ITP)  
   
 scintilla:  
 scite  
 qscintilla  
 geany  
   
 libphp-adodb:  
 gallery2  
 phppgadmin  
 egroupware  
 phpwiki  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
   
 gzip:  
 linux-kernel (lib/inflate.c)  
 klibc (based on linux-kernel gzip code)  
 busybox  
   
 ffmpeg:  
 mplayer (#395252)  
   
 neon:  
 cadaver (all, but being worked on: #188381)  
 gnome-vfs2 (#395874)  
 litmus (#395875)  
 screem (sarge only)  
 sitecopy (#395876)  
 tla (etch/sid only: #395877)  
   
 libmodplug:  
 gst-plugins-bad0.10  
   
 libvncserver:  
 vino  
   
 putty:  
 filezilla  
   
 tinyxml (not packaged in Debian):  
 filezilla  
   
 gv:  
 evince (ps/ tree from gv 3.5.8)  
 evince-gtk (not packaged in Debian)  
   
 libXbae:  
 libpawlib2-lesstif package (from Cernlib)  
   
 libXaw:  
 libpawlib2-lesstif package (from Cernlib)  
   
 (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  
273    
274  libgd2:  giflib:
275  graphviz (lib/gd seems to be 2.0.33)          - wine <unfixed> (embed; bug #466181)
276    
277  rar:  bennu (not packaged in Debian)
278  unrar-nonfree          - moodle <unfixed> (embed)
279    
280  unrar-free: (maybe this code is derived from the original rar, too?)  smarty:
281  clamav (seems to be disabled in default config)          - moodle <unfixed> (embed)
282    
283    TinyMCE
284            - wordpress <unfixed> (embed)
285            - moodle <unfixed> (embed)
286            - knowledgeroot <unfixed> (embed)
287            - joomla <itp> (bug #326398)
288    
289    scintilla
290            - scite <unfixed> (embed)
291            - qscintilla <unfixed> (embed)
292            - qscintilla2 <unfixed> (embed)
293            - geany <unfixed> (embed)
294    
295    libphp-adodb
296            - moodle <unfixed> (embed)
297            NOTE: also AdoDB-XML Schema
298            - gallery2 <unfixed> (embed)
299            - phppgadmin <unfixed> (embed)
300            - egroupware <unfixed> (embed)
301            - phpwiki <unfixed> (embed)
302            - ipplan <unfixed> (embed)
303            - typo3 <unfixed> (embed)
304            - moodle <unfixed> (embed)
305            - cacti <unknown> (embed)
306            [sarge] - cacti <unfixed> (embed)
307            NOTE: dependency exists, but internal version is used
308    
309    gzip
310            - linux-kernel <unfixed> (embed)
311            NOTE: lib/inflate.c
312            - klibc <unfixed> (embed)
313            NOTE: based on linux-kernel gzip code
314            - busybox <unfixed> (embed)
315    
316    neon
317            - cadaver <unfixed> (embed; bug #188381)
318            - gnome-vfs2 <unfixed> (embed; bug #395874)
319            - litmus <unfixed> (embed; #395875)
320            [sarge] - screem <unfixed> (embed)
321            - sitecopy <unfixed> (embed; bug #395876)
322            [etch] - tla <unfixed> (embed; bug #395877)
323            [sarge] - tla <unfixed> (embed; bug #395877)
324    
325    libmodplug
326            - gst-plugins-bad0.10 <unfixed> (embed)
327    
328    libvncserver
329            - vino <unfixed> (embed)
330    
331    putty
332            - filezilla <unfixed> (embed)
333    
334    tinyxml (not packaged in Debian)
335            - filezilla <unfixed>
336    
337    gv
338            - evince <unfixed> (embed)
339            NOTE: ps/ tree from gv 3.5.8
340            - evince-gtk <unfixed> (embed)
341            NOTE: not packaged in Debian
342    
343    libXbae
344            [etch] - libpawlib2-lesstif <unfixed> (embed)
345            NOTE: from Cernlib
346    
347    libXaw
348            [etch] - libpawlib2-lesstif
349            NOTE: from Cernlib
350            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
351    
352    libgd2
353            - graphviz <unfixed> (embed)
354            NOTE: lib/gd seems to be 2.0.33
355            - wml <unfixed> (embed)
356            NOTE: derived from gd 1.6.3
357    
358    rar
359            - unrar-nonfree <unfixed> (embed)
360    
361    unrar-free (maybe this code is derived from the original rar, too?)
362            - clamav <unfixed> (embed)
363            NOTE: seems to be disabled in default config
364    
365    mplayer (DirectMedia Object loader)
366            - xine-lib <unfixed> (embed)
367            NOTE: src/libw32dll/
368            - vlc <unfixed> (embed)
369            NOTE: modules/codec/dmo/
370    
371    libwpd (WordPerfect converter)
372            - openoffice.org <unfixed> (embed)
373    
374    fsplib (http://sourceforge.net/projects/fsp/)
375            - gftp <unfixed> (embed)
376            NOTE: lib/fsplib version 0.3
377    
378    librpcsecgss
379            - krb5 <unfixed> (embed)
380    
381    jasper
382            - ghostscript <unfixed> (embed)
383            - gs-gpl <unfixed> (embed)
384    
385    libidn
386            - monotone <unfixed> (embed)
387    
388    liblua
389            - monotone <unfixed> (embed)
390    
391    libbotan
392            - montone <unfixed> (embed)
393    
394    NetXX
395            - monotone <unfixed> (embed)
396    
397    libgc
398            - mono <unfixed> (embed)
399    
400    lzma
401            - p7zip <unfixed> (embed)
402    
403    lzo
404            - grub2 <unfixed> (embed)
405    
406    yassl
407            - mysql-dfsg-5.0 <unfixed> (embed)
408    
409    pax code
410            - tar <unfixed> (embed)
411            - cpio <unfixed> (embed)
412    
413    t1lib
414            - tetex-bin 2.0.2-1 (embed)
415            - texlive-bin <unknown> (embed)
416    
417    guichan
418            - boswars <unfixed> (embed)
419            NOTE: maintainer notified us, working on it
420    
421    tolua
422            - boswars <unfixed> (embed)
423            NOTE: maintainer notified us, working on it
424    
425    asio-dev
426            - luxrender <unfixed> (embed)
427            NOTE: maintainer notified us, working on it
428            NOTE: may be merged with boost "soon"
429    
430    xine-lib
431            - vlc <unfixed> (embed)
432            NOTE: only parts included in modules/access/rtsp
433    
434    netpbm
435            - tcl8.3 <unfixed> (embed)
436            - tcl8.4 <unfixed> (embed)
437            - tcl8.5 <unfixed> (embed)
438            NOTE: generic/tkImgGIF.c
439    
440    tk8.5
441            - tk8.0 <removed> (old-version)
442            - tk8.3 <unfixed> (old-version)
443            - tk8.4 <unfixed> (old-version)
444            - perl-tk <unfixable> (fork)

Legend:
Removed from v.5440  
changed lines
  Added in v.8175

  ViewVC Help
Powered by ViewVC 1.1.5