/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1608 by stef-guest, Fri Aug 19 10:07:47 2005 UTC revision 8337 by micah, Sat Mar 15 17:11:55 2008 UTC
# Line 1  Line 1 
1  This file collects cases, where a source package embeds code from  Embedded code copies
2  other projects, without linking dynamically:  ====================
3    
4  xpdf code: (some use xpdf 2, some xpdf 3)  This file collects source packages that embed code from other projects.
5  gpdf  This is considered bad for fixing security flaws because the fix needs
6  pdftohtml  to be applied in multiple source packages.
7  kdegraphics/kpdf  
8  tetex-bin  Format:
9  cupsys (only older releases, recent ones use xpdf-utils)  <srcpkg> (<optional comment about srcpkg>)
10            - <embedding srcpkg> <status> (<sort>; bug #<number>)
11            NOTE: optional comments about the linkage of the embedding srcpkg
12  zlib code: (separate between 1.2 and 1.1)  
13  dpkg  status: version number fixing the embedded copy, <unfixed>, <removed>,
14  rsync          <itp> or <unknown> if the version number can not be determined
15  mozilla-firefox          <unfixable> for unavoidable cases (e.g., forks that add real value)
16  mozilla(?)  sort: static (linking statically against a lib)
17  Linux kernels        embed (embedding a copy of the library into another source package)
18          fork (the package is not just embedding code but it is a fork and
19                thus might share parts of the source code)
20  libgadu/ekg:        old-version (the package is an older version of essentially
21  centericq                     the same code)
22  gaim  
23  kopete (ships the code, but links dynamically in the Debian package)  The srcpkg might be some string to identify the code if there is no
24  kadu (not packaged in Debian)  specific source package.
25  GNU gadu (not packaged in Debian)  
26    Everything up to the next line is ignored.
27    ---BEGIN
28  xmlrpc: (which package is the "origin" of this code?)  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29  drupal          NOTE: Fixed packages link to poppler library unless otherwise noted
30  phpgroupware          - gpdf <removed>
31  egroupware          [sarge] - gpdf <unfixed>
32  phpwiki          NOTE: has been replaced by evince in etch
33  php4 (php-pear, IIRC this was reorganized some weeks ago?)          - pdftohtml <unknown>
34  tikiwiki (not packaged in Debian)          [sarge] - pdftohtml <unfixed>
35            [etch] - pdftohtml <unfixed>
36            NOTE: has been replaced by poppler-utils
37  shtool: (affects build-time only)          - kdegraphics <unfixed> (embed; bug #436164)
38  mysql-ocaml          NOTE: the kpdf replacement in KDE 4 is using poppler
39  php4          - tetex-bin 3.0-12 (embed)
40            - texlive-bin 2007-1 (embed)
41            NOTE: links to poppler
42  mozilla:          - koffice <unfixed> (embed; bug #436163)
43  mozilla-firefox          - libextractor 0.5.12-1 (embed)
44  mozilla-thunderbird          NOTE: libextractor is using its own pdf decoder now
45  nvu          - libextractor 0.5.12-1 (embed)
46            - pdfkit.framework 0.8-4 (embed)
47            - ipe <unfixed> (embed)
48  xli:          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
49  xloadimage          - ruby-gnome2 <unknown> (embed)
50            NOTE: copy only present in source but links to poppler
51    
52  lesstif: (beware: two different lesstif APIs supported in one package, 1.2 discarded upstream)  ppmd
53  openmotif          - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
54  xfree86/xorg (in libxpm, still the case with x.org?  
55    peercast
56            - gnome-peercast <unfixed> (embed)
57  kerberized apps with BSD origin:          NOTE: gnome-peercast may better be removed, see #466539
58  krb4  
59  krb5  silc-toolkit
60  heimdal          - silc-client 1.1~beta6-1 (embed)
61    
62    dietlibc
63  grip: (which pkg is the origin?)          - ccontrol 0.9.1+20071204-1 (static)
64  libcdaudio  
65  grip  libiax
66  gnome-vfs (vfs2 as well?)          - iaxmodem <unfixed> (embed)
67    
68    zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
69  fudforum:          - dpkg <unfixed> (embed)
70  phpgroupware-fudforum          NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
71  egroupware-fudforum          - rsync <unfixed> (embed)
72            NOTE: somehow derived code base
73            - mono <unfixed> (embed)
74            TODO: check mozilla
75            - Linux kernels <unfixed> (embed)
76            - pvpgn 1.7.8-2 (embed)
77            - mrtg 2.12.2-1 (embed)
78            - rpm <unknown> (embed)
79            NOTE: pinged anibal since when rpm was fixed
80    
81    libbz2
82            - dpkg <unfixed> (static)
83    
84    ekg
85            - centericq <unfixed> (embed)
86            - gaim <unfixed> (embed)
87            - pigdin <unfixed> (embed)(links dynamically against libgadu)
88            - kopete 4:3.3.2-5 (embed)
89            - kadu <unfixed> (embed)
90            - gadu <unfixed> (embed)
91            NOTE: g/kadu not packaged in Debian yet
92    
93    xmlrpc (which package is the "origin" of this code?)
94            - drupal <unfixed> (embed)
95            - phpgroupware <unfixed> (embed)
96            - egroupware <unfixed> (embed)
97            - phpwiki (embed)
98            - php4 <unfixed> (embed)
99            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
100    
101    shtool (affects build-time only)
102            - mysql-ocaml <unfixed> (embed)
103            - php4 <unfixed> (embed)
104    
105    mozilla source code
106            - mozilla-firefox <unfixed> (embed)
107            - mozilla-thunderbird
108            - firefox <removed>
109            [etch] - firefox <unfixed> (embed)
110            - thunderbird <removed>
111            [etch] - thunderbird <unfixed> (embed)
112            - iceweasel <unfixed> (embed)
113            - iceape <unfixed> (embed)
114            - icedove <unfixed> (embed)
115            - xulrunner <unfixed> (embed)
116            - nvu <removed> (embed)
117    
118    xli
119            - xloadimage <unfixed> (embed)
120    
121    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
122            - openmotif <unfixed> (embed)
123            - xfree86/xorg <unfixed> (embed)
124            NOTE: in libxpm
125    
126    kerberized apps with BSD origin
127            - krb4 <unfixed> (embed)
128            - krb5 <unfixed> (embed)
129            - heimdal <unfixed> (embed)
130    
131    grip (which pkg is the origin?)
132            - libcdaudio
133            - grip
134            - gnome-vfs
135            TODO: check vfs2 as well
136    
137    fudforum
138            - phpgroupware-fudforum <unfixed> (embed)
139            - egroupware-fudforum <removed>
140            [sarge] - egroupware-fudforum <unfixed> (embed)
141    
142    cvs
143            - gcvs <unfixed> (embed)
144            NOTE: see cvsunix/src in tarball
145    
146    pcre
147            - python* <unfixed> (embed)
148            - php4 <unknown> (embed)
149            - analog 2:5.23-0woody1 (embed)
150            - libgoffice-1 <unfixed> (embed)
151            - vfu 4.06-4.1 (embed; bug #450754)
152            - tf5 5.0beta7-1 (embed)
153            - monotone <unfixed> (embed)
154            NOTE: this only affects versions >= 0.37
155            - glib <unfixed> (embed)
156            NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic
157            - apache2 2.0.53-4 (embed)
158            - exim4 4.10-0.srh20.12 (embed)
159            - yacas <unfixed> (embed)
160            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
161            - gtamsanalyzer.app 0.42-5 (embed)
162    
163    tiff
164            - wxpythongtk <unfixed> (embed)
165            TODO: check, which debian pkg this is in
166    
167    uudeview
168            - libconvert-uulib-perl <unfixed> (embed)
169    
170    sqlite (not affected by security vulnerabilities so far)
171            - amarok <unfixed> (embed)
172            - monotone <unfixed> (embed)
173            - iceweasel <unfixed> (embed)
174    
175    util-linux/mount
176            - loop-aes-utils <unfixed> (embed)
177            NOTE: contains code from util-linux' mount in the mount-aes-udeb
178    
179    webmin
180            - usermin <unknown> (embed)
181            [sarge] - usermin <unfixed> (embed)
182    
183    sylpheed
184            - sylpheed-claws <unfixed> (fork)
185    
186    phpsysinfo
187            - egroupware <unfixed> (embed)
188            - phpgroupware <unfixed> (embed)
189    
190    phpldapadmin
191            [sarge] - egroupware <unfixed> (embed)
192            NOTE: removed from egroupware after sarge
193    
194    chmlib
195            - kchmviewer <unknown> (embed)
196    
197    libavcodec/libavformat (source: ffmpeg)
198            - mplayer <unfixed> (embed; bug #395252)
199            - xvidcap <unfixed> (embed)
200            - kino <unfixed> (static)
201            - vlc <unfixed> (static)
202            - smilutils <unfixed> (static)
203            - motion <unfixed> (static)
204            - gst-ffmpeg <unfixed> (embed)
205            - gstreamer0.10-ffmpeg <unfixed> (embed)
206            - xmovie <unfixed>
207            TODO: gimp-gap (potentially using ffmpeg code as well)
208    
209    mad MPEG decoding lib
210            - mad <unfixed> (embed)
211            - xine-lib <unfixed> (embed)
212    
213    libdts
214            - xine-lib <unfixed> (embed)
215    
216    flac
217            - xine-lib <unfixed> (embed)
218    
219    liba52
220            - a52dec <unfixed> (embed)
221            - xine-lib <unfixed> (embed)
222    
223    libmpeg2
224            - mpeg2dec <unfixed> (embed)
225            - xine-lib <unfixed> (embed)
226    
227    curl
228            - wget <unfixed> (embed)
229            NOTE: code for NTLM authentication
230    
231    uw-imap
232            - pine <unfixed> (embed)
233            - alpine <unfixed> (embed)
234    
235    imagemagick
236            - graphicsmagick <unfixed> (fork)
237    
238    halibut
239            - nsis <unfixed> (embed)
240    
241    libghttp
242            - hotway <unfixed> (embed)
243    
244    libsndfile
245            - ardour <unfixed> (embed)
246    
247    glibmm2.4
248            - ardour <unfixed> (embed)
249    
250    libgnomecanvasmm2.6
251            - ardour <unfixed> (embed)
252    
253    libsigc++-2.0
254            - ardour <unfixed> (embed)
255    
256    soundtouch
257            - ardour <unfixed> (embed)
258    
259    libmms
260            - xine-lib <unfixed> (embed)
261            - mimms <unfixed> (embed)
262    
263    fckeditor
264            - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
265            - moin <unfixed> (embed; bug #452599)
266            - karrigell <unfixed> (embed; bug #452598)
267            - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
268    
269    ipatlas (not packaged in Debian)
270            - moodle <unfixed> (embed)
271    
272    libphp-phpmailer
273            - moodle <unfixed> (embed)
274    
275    htmlArea (not packaged in Debian)
276            - moodle <unfixed> (embed)
277    
278    giflib:
279            - wine <unfixed> (embed; bug #466181)
280    
281    bennu (not packaged in Debian)
282            - moodle <unfixed> (embed)
283    
284    smarty:
285            - moodle <unfixed> (embed)
286    
287    TinyMCE
288            - wordpress <unfixed> (embed)
289            - moodle <unfixed> (embed)
290            - knowledgeroot <unfixed> (embed)
291            - joomla <itp> (bug #326398)
292    
293    scintilla
294            - scite <unfixed> (embed)
295            - qscintilla <unfixed> (embed)
296            - qscintilla2 <unfixed> (embed)
297            - geany <unfixed> (embed)
298    
299    libphp-adodb
300            - moodle <unfixed> (embed)
301            NOTE: also AdoDB-XML Schema
302            - gallery2 <unfixed> (embed)
303            - phppgadmin <unfixed> (embed)
304            - egroupware <unfixed> (embed)
305            - phpwiki <unfixed> (embed)
306            - ipplan <unfixed> (embed)
307            - typo3 <unfixed> (embed)
308            - moodle <unfixed> (embed)
309            - cacti <unknown> (embed)
310            [sarge] - cacti <unfixed> (embed)
311            NOTE: dependency exists, but internal version is used
312    
313    gzip
314            - linux-kernel <unfixed> (embed)
315            NOTE: lib/inflate.c
316            - klibc <unfixed> (embed)
317            NOTE: based on linux-kernel gzip code
318            - busybox <unfixed> (embed)
319    
320    neon
321            - cadaver <unfixed> (embed; bug #188381)
322            - gnome-vfs2 <unfixed> (embed; bug #395874)
323            - litmus <unfixed> (embed; #395875)
324            [sarge] - screem <unfixed> (embed)
325            - sitecopy <unfixed> (embed; bug #395876)
326            [etch] - tla <unfixed> (embed; bug #395877)
327            [sarge] - tla <unfixed> (embed; bug #395877)
328    
329    libmodplug
330            - gst-plugins-bad0.10 <unfixed> (embed)
331    
332    libvncserver
333            - vino <unfixed> (embed)
334    
335    putty
336            - filezilla <unfixed> (embed)
337    
338    tinyxml (not packaged in Debian)
339            - filezilla <unfixed>
340    
341    gv
342            - evince <unfixed> (embed)
343            NOTE: ps/ tree from gv 3.5.8
344            - evince-gtk <unfixed> (embed)
345            NOTE: not packaged in Debian
346    
347    libXbae
348            [etch] - libpawlib2-lesstif <unfixed> (embed)
349            NOTE: from Cernlib
350    
351    libXaw
352            [etch] - libpawlib2-lesstif
353            NOTE: from Cernlib
354            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
355    
356    libgd2
357            - graphviz <unfixed> (embed)
358            NOTE: lib/gd seems to be 2.0.33
359            - wml <unfixed> (embed)
360            NOTE: derived from gd 1.6.3
361    
362    rar
363            - unrar-nonfree <unfixed> (embed)
364    
365    unrar-free (maybe this code is derived from the original rar, too?)
366            - clamav <unfixed> (embed)
367            NOTE: seems to be disabled in default config
368    
369    mplayer (DirectMedia Object loader)
370            - xine-lib <unfixed> (embed)
371            NOTE: src/libw32dll/
372            - vlc <unfixed> (embed)
373            NOTE: modules/codec/dmo/
374    
375    libwpd (WordPerfect converter)
376            - openoffice.org <unfixed> (embed)
377    
378    fsplib (http://sourceforge.net/projects/fsp/)
379            - gftp <unfixed> (embed)
380            NOTE: lib/fsplib version 0.3
381    
382    librpcsecgss
383            - krb5 <unfixed> (embed)
384    
385    jasper
386            - ghostscript <unfixed> (embed)
387            - gs-gpl <unfixed> (embed)
388    
389    libidn
390            - monotone <unfixed> (embed)
391    
392    liblua
393            - monotone <unfixed> (embed)
394    
395    libbotan
396            - montone <unfixed> (embed)
397    
398    NetXX
399            - monotone <unfixed> (embed)
400    
401    libgc
402            - mono <unfixed> (embed)
403    
404    lzma
405            - p7zip <unfixed> (embed)
406    
407    lzo
408            - grub2 <unfixed> (embed)
409    
410    yassl
411            - mysql-dfsg-5.0 <unfixed> (embed)
412    
413    pax code
414            - tar <unfixed> (embed)
415            - cpio <unfixed> (embed)
416    
417    t1lib
418            - tetex-bin 2.0.2-1 (embed)
419            - texlive-bin <unknown> (embed)
420    
421    guichan
422            - boswars <unfixed> (embed)
423            NOTE: maintainer notified us, working on it
424    
425    tolua
426            - boswars <unfixed> (embed)
427            NOTE: maintainer notified us, working on it
428    
429    asio-dev
430            - luxrender <unfixed> (embed)
431            NOTE: maintainer notified us, working on it
432            NOTE: may be merged with boost "soon"
433    
434    xine-lib
435            - vlc <unfixed> (embed)
436            NOTE: only parts included in modules/access/rtsp
437    
438    netpbm
439            - tcl8.3 <unfixed> (embed)
440            - tcl8.4 <unfixed> (embed)
441            - tcl8.5 <unfixed> (embed)
442            NOTE: generic/tkImgGIF.c
443    
444    tk8.5
445            - tk8.0 <removed> (old-version)
446            - tk8.3 <unfixed> (old-version)
447            - tk8.4 <unfixed> (old-version)
448            - perl-tk <unfixable> (fork)
449    
450    samba
451            - mc <unfixed> (embed)
452            NOTE: maintainer is aware of this, currently searching a solution
453    
454    plib1.8.4c2
455            - boson <unfixed> (fork)
456            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar

Legend:
Removed from v.1608  
changed lines
  Added in v.8337

  ViewVC Help
Powered by ViewVC 1.1.5