/[secure-testing]/data/embedded-code-copies

Diff of /data/embedded-code-copies

Parent Directory | Revision Log | View Patch Patch

-revision 7985 by thijs,
Sun Jan 20 10:31:59 2008 UTC
+revision 8587 by nion,
Sun Apr 20 18:24:56 2008 UTC
 Line 1
  Embedded code copies
  ====================
- This file collects cases, where a source package embeds code from
+ This file collects source packages that embed code from other projects.
- other projects which is considered bad for fixing security flaws
+ This is considered bad for fixing security flaws because the fix needs
- because the fix needs to be applied in multiple source packages.
+ to be applied in multiple source packages.
  Format:
  <srcpkg> (<optional comment about srcpkg>)
          - <embedding srcpkg> <status> (<sort>; bug #<number>)
          NOTE: optional comments about the linkage of the embedding srcpkg
- status: version number fixing the embedded copy, <unfixed>, <removed>, <itp> or <unknown> if the version number can not be determined
+ status: version number fixing the embedded copy, <unfixed>, <removed>,
+         <itp> or <unknown> if the version number can not be determined
+         <unfixable> for unavoidable cases (e.g., forks that add real value)
  sort: static (linking statically against a lib)
        embed (embedding a copy of the library into another source package)
-       fork (the package is not just embedding code but it is a fork and thus might share parts of the source code)
+       fork (the package is not just embedding code but it is a fork and
+             thus might share parts of the source code)
+       old-version (the package is an older version of essentially
+                    the same code)
- The srcpkg might be some string to identify the code if there is no specific source package.
+ The srcpkg might be some string to identify the code if there is no
+ specific source package.
- Everything up to the next line is ignored
+ Everything up to the next line is ignored.
  ---BEGIN
  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
          NOTE: Fixed packages link to poppler library unless otherwise noted
-Line 46 
 xpdf (some srcpkgs use xpdf2 code, some
+Line 52 
 xpdf (some srcpkgs use xpdf2 code, some
  ppmd
          - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
+ peercast
+         - gnome-peercast <unfixed> (embed)
+         NOTE: gnome-peercast may better be removed, see #466539
  silc-toolkit
          - silc-client 1.1~beta6-1 (embed)
-Line 149 
 pcre
+Line 159 
 pcre
          - yacas <unfixed> (embed)
          NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
          - gtamsanalyzer.app 0.42-5 (embed)
+         - tin <unknown> (embed)
  tiff
-         - wxpythongtk <unfixed> (embed)
+         - wxwindows2.4 2.2.1 (embed)
-         TODO: check, which debian pkg this is in
  uudeview
          - libconvert-uulib-perl <unfixed> (embed)
-Line 251 
 libmms
+Line 261 
 libmms
          - mimms <unfixed> (embed)
  fckeditor
-         - knowledgeroot <unfixed> (embed; bug #461555)
+         - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
          - moin <unfixed> (embed; bug #452599)
          - karrigell <unfixed> (embed; bug #452598)
          - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
-Line 265 
 libphp-phpmailer
+Line 275 
 libphp-phpmailer
  htmlArea (not packaged in Debian)
          - moodle <unfixed> (embed)
+ giflib:
+         - wine <unfixed> (embed; bug #466181)
  bennu (not packaged in Debian)
          - moodle <unfixed> (embed)
  smarty:
-         - moodle <unfixed> (embed)
+         - moodle <unfixed> (embed; bug #471158)
+         - gallery2 <unfixed> (embed; bug #471160)
+         - mahara 0.9.2-2 (embed; bug #471201)
+         - gosa 2.4beta1-1 (embed; bug #471200)
  TinyMCE
          - wordpress <unfixed> (embed)
-Line 343 
 libXaw
+Line 359 
 libXaw
  libgd2
          - graphviz <unfixed> (embed)
          NOTE: lib/gd seems to be 2.0.33
+         - wml <unfixed> (embed)
+         NOTE: derived from gd 1.6.3
  rar
          - unrar-nonfree <unfixed> (embed)
-Line 416 
 asio-dev
+Line 434 
 asio-dev
          NOTE: maintainer notified us, working on it
          NOTE: may be merged with boost "soon"
+ xine-lib
+         - vlc <unfixed> (embed)
+         NOTE: only parts included in modules/access/rtsp
+ netpbm
+         - tcl8.3 <unfixed> (embed)
+         - tcl8.4 <unfixed> (embed)
+         - tcl8.5 <unfixed> (embed)
+         NOTE: generic/tkImgGIF.c
+ tk8.5
+         - tk8.0 <removed> (old-version)
+         - tk8.3 <unfixed> (old-version)
+         - tk8.4 <unfixed> (old-version)
+         - perl-tk <unfixable> (fork)
+ samba
+         - mc <unfixed> (embed)
+         NOTE: maintainer is aware of this, currently searching a solution
+ plib1.8.4c2
+         - boson <unfixed> (fork)
+         NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
+ fribidi
+         - quesoglc <unfixed> (embed)
+ glew
+         - quesoglc <unfixed> (embed)
+ minorGems
+         - transcend <unfixed> (embed)
+         - cultivation <unfixed> (embed)
+ libarchive
+         - tar <unfixed> (embed)
+         NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
+         - cpio <unfixed> (embed)
+         NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
+ webkit
+         - qt4-x11 <unfixed> (embed)

 Legend:



Removed from v.7985
 


changed lines


 
Added in v.8587
 Legend:



Removed from v.7985
 


changed lines


 
Added in v.8587
-Removed from v.7985
+Added in v.8587

	ViewVC Help
Powered by ViewVC 1.1.5