/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Contents of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log


Revision 10231 - (show annotations) (download)
Sun Nov 2 04:48:52 2008 UTC (4 years, 6 months ago) by atomo64-guest
File size: 14848 byte(s)
Know about the embedded copy of Snoopy.class in wordpress and moodle (CVE-2008-4796), and the bug number for wordpress/CVE-2008-1502
1 Embedded code copies
2 ====================
3
4 This file collects source packages that embed code from other projects.
5 This is considered bad for fixing security flaws because the fix needs
6 to be applied in multiple source packages.
7
8 Format:
9 <srcpkg> (<optional comment about srcpkg>)
10 - <embedding srcpkg> <status> (<sort>; bug #<number>)
11 NOTE: optional comments about the linkage of the embedding srcpkg
12
13 status: version number fixing the embedded copy, <unfixed>, <removed>,
14 <itp> or <unknown> if the version number can not be determined
15 <unfixable> for unavoidable cases (e.g., forks that add real value)
16 sort: static (linking statically against a lib)
17 embed (embedding a copy of the library into another source package)
18 fork (the package is not just embedding code but it is a fork and
19 thus might share parts of the source code)
20 old-version (the package is an older version of essentially
21 the same code)
22
23 The srcpkg might be some string to identify the code if there is no
24 specific source package.
25
26 Everything up to the next line is ignored.
27 ---BEGIN
28 xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29 NOTE: Fixed packages link to poppler library unless otherwise noted
30 - gpdf <removed>
31 [sarge] - gpdf <unfixed>
32 NOTE: has been replaced by evince in etch
33 - pdftohtml <unknown>
34 [sarge] - pdftohtml <unfixed>
35 [etch] - pdftohtml <unfixed>
36 NOTE: has been replaced by poppler-utils
37 - kdegraphics <unfixed> (embed; bug #436164)
38 NOTE: the kpdf replacement in KDE 4 is using poppler
39 - texlive-base 3.0-12 (embed)
40 - texlive-bin 2007-1 (embed)
41 NOTE: links to poppler
42 - koffice <unfixed> (embed; bug #436163)
43 - libextractor 0.5.12-1 (embed)
44 NOTE: libextractor is using its own pdf decoder now
45 - libextractor 0.5.12-1 (embed)
46 - pdfkit.framework 0.8-4 (embed)
47 - ipe <unfixed> (embed)
48 NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
49 - ruby-gnome2 <unknown> (embed)
50 NOTE: copy only present in source but links to poppler
51
52 ppmd
53 - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
54
55 peercast
56 - gnome-peercast <unfixed> (embed)
57 NOTE: gnome-peercast may better be removed, see #466539
58
59 silc-toolkit
60 - silc-client 1.1~beta6-1 (embed)
61
62 dietlibc
63 - ccontrol 0.9.1+20071204-1 (static)
64
65 libiax
66 - iaxmodem <unfixed> (embed)
67
68 zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
69 - dpkg <unfixed> (embed)
70 NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
71 - rsync <unfixed> (embed)
72 NOTE: somehow derived code base
73 - mono <unfixed> (embed)
74 TODO: check mozilla
75 - Linux kernels <unfixed> (embed)
76 - pvpgn 1.7.8-2 (embed)
77 - mrtg 2.12.2-1 (embed)
78 - rpm <unknown> (embed)
79 NOTE: pinged anibal since when rpm was fixed
80
81 libbz2
82 - dpkg <unfixed> (static)
83
84 ekg
85 - centericq <unfixed> (embed)
86 - gaim <unfixed> (embed)
87 - pigdin <unfixed> (embed)(links dynamically against libgadu)
88 - kopete 4:3.3.2-5 (embed)
89 - kadu <unfixed> (embed)
90 - gadu <unfixed> (embed)
91 NOTE: g/kadu not packaged in Debian yet
92
93 xmlrpc (which package is the "origin" of this code?)
94 - drupal <unfixed> (embed)
95 - phpgroupware <unfixed> (embed)
96 - egroupware <unfixed> (embed)
97 - phpwiki (embed)
98 - php4 <unfixed> (embed)
99 TODO: check, php-pear, IIRC this was reorganized some weeks ago?
100
101 shtool (affects build-time only)
102 - mysql-ocaml <unfixed> (embed)
103 - php4 <unfixed> (embed)
104
105 mozilla source code
106 - mozilla-firefox <unfixed> (embed)
107 - mozilla-thunderbird
108 - firefox <removed>
109 [etch] - firefox <unfixed> (embed)
110 - thunderbird <removed>
111 [etch] - thunderbird <unfixed> (embed)
112 - iceweasel <unfixed> (embed)
113 - iceape <unfixed> (embed)
114 - icedove <unfixed> (embed)
115 - xulrunner <unfixed> (embed)
116 - nvu <removed> (embed)
117
118 xli
119 - xloadimage <unfixed> (embed)
120
121 lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
122 - openmotif <unfixed> (embed)
123 - xfree86/xorg <unfixed> (embed)
124 NOTE: in libxpm
125
126 kerberized apps with BSD origin
127 - krb4 <unfixed> (embed)
128 - krb5 <unfixed> (embed)
129 - heimdal <unfixed> (embed)
130
131 grip (which pkg is the origin?)
132 - libcdaudio
133 - grip
134 - gnome-vfs
135 TODO: check vfs2 as well
136
137 fudforum
138 - phpgroupware-fudforum <unfixed> (embed)
139 - egroupware-fudforum <removed>
140 [sarge] - egroupware-fudforum <unfixed> (embed)
141
142 cvs
143 - gcvs <unfixed> (embed)
144 NOTE: see cvsunix/src in tarball
145
146 pcre
147 - python* <unfixed> (embed)
148 - php4 <unknown> (embed)
149 - analog 2:5.23-0woody1 (embed)
150 - libgoffice-1 <unfixed> (embed)
151 - vfu 4.06-4.1 (embed; bug #450754)
152 - tf5 5.0beta7-1 (embed)
153 - monotone <unfixed> (embed)
154 NOTE: this only affects versions >= 0.37
155 - glib2.0 2.15.2-1 (embed)
156 - apache2 2.0.53-4 (embed)
157 - exim4 4.10-0.srh20.12 (embed)
158 - yacas <unfixed> (embed)
159 NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
160 - gtamsanalyzer.app 0.42-5 (embed)
161 - tin <unknown> (embed)
162 - kazehakase 0.5.2-1
163 - webkit <unfixed> (embed)
164 - qt4-x11 <unfixed> (embed)
165 NOTE: embedded via webkit copy
166
167 tiff
168 - wxwindows2.4 2.2.1 (embed)
169
170 uudeview
171 - libconvert-uulib-perl <unfixed> (embed)
172 - pan <unfixed> (embed)
173
174 sqlite (not affected by security vulnerabilities so far)
175 - amarok <unfixed> (embed)
176 - monotone <unfixed> (embed)
177 - iceweasel <unfixed> (embed)
178
179 util-linux/mount
180 - loop-aes-utils <unfixed> (embed)
181 NOTE: contains code from util-linux' mount in the mount-aes-udeb
182
183 webmin
184 - usermin <unknown> (embed)
185 [sarge] - usermin <unfixed> (embed)
186
187 sylpheed
188 - sylpheed-claws <unfixed> (fork)
189
190 phpsysinfo
191 - egroupware <unfixed> (embed)
192 - phpgroupware <unfixed> (embed)
193
194 phpldapadmin
195 [sarge] - egroupware <unfixed> (embed)
196 NOTE: removed from egroupware after sarge
197
198 chmlib
199 - kchmviewer <unknown> (embed)
200
201 libavcodec/libavformat (source: ffmpeg)
202 - mplayer 1.0~rc2-14 (embed; bug #395252)
203 - kino 1.0.0-1
204 - vlc <not-affected> (Links dynamically since initial release)
205 - smilutils 0.3.0-10
206 NOTE: smilutils likely fixed earlier, marking Etch's version as fixed
207 - motion 3.1.19-1
208 - gstreamer0.10-ffmpeg 0.10.3-2
209 - xmovie <unfixed>
210 TODO: gimp-gap (potentially using ffmpeg code as well)
211
212 mad MPEG decoding lib
213 - mad <unfixed> (embed)
214 - xine-lib <unfixed> (embed)
215
216 libdts
217 - xine-lib <unfixed> (embed)
218
219 flac
220 - xine-lib <unfixed> (embed)
221
222 liba52
223 - a52dec <unfixed> (embed)
224 - xine-lib <unfixed> (embed)
225
226 libmpeg2
227 - mpeg2dec <unfixed> (embed)
228 - xine-lib <unfixed> (embed)
229
230 curl
231 - wget <unfixed> (embed)
232 NOTE: code for NTLM authentication
233
234 uw-imap
235 - pine <unfixed> (embed)
236 - alpine <unfixed> (embed)
237
238 imagemagick
239 - graphicsmagick <unfixed> (fork)
240
241 libphp-snoopy
242 - ampache <unfixed> (embed)
243 - mahara <unfixed> (embed)
244 - pixelpost <unfixed> (embed)
245
246 halibut
247 - nsis <unfixed> (embed)
248
249 libghttp
250 - hotway <unfixed> (embed)
251
252 libsndfile
253 - ardour <unfixed> (embed)
254
255 glibmm2.4
256 - ardour <unfixed> (embed)
257
258 libgnomecanvasmm2.6
259 - ardour <unfixed> (embed)
260
261 libsigc++-2.0
262 - ardour <unfixed> (embed)
263
264 soundtouch
265 - ardour <unfixed> (embed)
266
267 libmms
268 - xine-lib <unfixed> (embed)
269 - mimms <unfixed> (embed)
270
271 fckeditor
272 - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
273 - moin <unfixed> (embed; bug #452599)
274 - karrigell <removed> (embed; bug #452598)
275 - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
276
277 ipatlas (not packaged in Debian)
278 - moodle <unfixed> (embed)
279
280 libphp-phpmailer
281 - moodle <unfixed> (embed)
282
283 htmlArea (not packaged in Debian)
284 - moodle <unfixed> (embed)
285
286 giflib:
287 - wine <unfixed> (embed; bug #466181)
288
289 bennu (not packaged in Debian)
290 - moodle <unfixed> (embed)
291
292 smarty:
293 - moodle <unfixed> (embed; bug #471158)
294 - gallery2 2.2.5-2 (embed; bug #471160)
295 - mahara 0.9.2-2 (embed; bug #471201)
296 - gosa 2.4beta1-1 (embed; bug #471200)
297
298 TinyMCE
299 - wordpress 2.5.1-3 (embed; bug #478257)
300 - moodle <unfixed> (embed)
301 - knowledgeroot <unfixed> (embed)
302 - joomla <itp> (bug #326398)
303
304 scintilla
305 - scite <unfixed> (embed)
306 - qscintilla <unfixed> (embed)
307 - qscintilla2 <unfixed> (embed)
308 - geany <unfixed> (embed)
309
310 libphp-adodb
311 - moodle <unfixed> (embed)
312 NOTE: also AdoDB-XML Schema
313 - gallery2 <unfixed> (embed)
314 - phppgadmin <unfixed> (embed)
315 - egroupware <unfixed> (embed)
316 - phpwiki <unfixed> (embed)
317 - ipplan <unfixed> (embed)
318 - typo3 <unfixed> (embed)
319 - moodle <unfixed> (embed)
320 - cacti <unknown> (embed)
321 [sarge] - cacti <unfixed> (embed)
322 NOTE: dependency exists, but internal version is used
323
324 gzip
325 - linux-kernel <unfixed> (embed)
326 NOTE: lib/inflate.c
327 - klibc <unfixed> (embed)
328 NOTE: based on linux-kernel gzip code
329 - busybox <unfixed> (embed)
330
331 neon
332 - cadaver <unfixed> (embed; bug #188381)
333 - gnome-vfs2 <unfixed> (embed; bug #395874)
334 - litmus <unfixed> (embed; #395875)
335 [sarge] - screem <unfixed> (embed)
336 - sitecopy <unfixed> (embed; bug #395876)
337 [etch] - tla <unfixed> (embed; bug #395877)
338 [sarge] - tla <unfixed> (embed; bug #395877)
339
340 libmodplug
341 - gst-plugins-bad0.10 <unfixed> (embed)
342
343 libvncserver
344 - vino <unfixed> (embed)
345
346 putty
347 - filezilla <unfixed> (embed)
348
349 tinyxml (not packaged in Debian)
350 - filezilla <unfixed>
351
352 gv
353 - evince <unfixed> (embed)
354 NOTE: ps/ tree from gv 3.5.8
355 - evince-gtk <unfixed> (embed)
356 NOTE: not packaged in Debian
357
358 libXbae
359 [etch] - libpawlib2-lesstif <unfixed> (embed)
360 NOTE: from Cernlib
361
362 libXaw
363 [etch] - libpawlib2-lesstif
364 NOTE: from Cernlib
365 NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
366
367 libgd2
368 - graphviz <unfixed> (embed)
369 NOTE: lib/gd seems to be 2.0.33
370 - wml <unfixed> (embed)
371 NOTE: derived from gd 1.6.3
372
373 rar
374 - unrar-nonfree <unfixed> (embed)
375
376 unrar-free (maybe this code is derived from the original rar, too?)
377 - clamav <unfixed> (embed)
378 NOTE: seems to be disabled in default config
379
380 mplayer (DirectMedia Object loader)
381 - xine-lib <unfixed> (embed)
382 NOTE: src/libw32dll/
383 - vlc <unfixed> (embed)
384 NOTE: modules/codec/dmo/
385
386 libwpd (WordPerfect converter)
387 - openoffice.org <unfixed> (embed)
388
389 fsplib (http://sourceforge.net/projects/fsp/)
390 - gftp <unfixed> (embed)
391 NOTE: lib/fsplib version 0.3
392
393 sprng
394 - tree-puzzle <unfixed> (embed)
395
396 librpcsecgss
397 - krb5 <unfixed> (embed)
398
399 jasper
400 - ghostscript <unfixed> (embed)
401 - gs-gpl <unfixed> (embed)
402
403 libidn
404 - monotone <unfixed> (embed)
405
406 liblua
407 - monotone <unfixed> (embed)
408
409 libbotan
410 - montone <unfixed> (embed)
411
412 NetXX
413 - monotone <unfixed> (embed)
414
415 libgc
416 - mono <unfixed> (embed)
417
418 lzma
419 - p7zip <unfixed> (embed)
420
421 lzo
422 - grub2 <unfixed> (embed)
423
424 yassl
425 - mysql-dfsg-5.0 <unfixed> (embed)
426
427 pax code
428 - tar <unfixed> (embed)
429 - cpio <unfixed> (embed)
430
431 t1lib
432 - tetex-bin 2.0.2-1 (embed)
433 - texlive-bin <unknown> (embed)
434
435 guichan
436 - boswars <unfixed> (embed)
437 NOTE: maintainer notified us, working on it
438
439 tolua
440 - boswars <unfixed> (embed)
441 NOTE: maintainer notified us, working on it
442
443 asio-dev
444 - luxrender <unfixed> (embed)
445 NOTE: maintainer notified us, working on it
446 NOTE: may be merged with boost "soon"
447
448 xine-lib
449 - vlc <unfixed> (embed)
450 NOTE: only parts included in modules/access/rtsp
451
452 netpbm
453 - tcl8.3 <unfixed> (embed)
454 - tcl8.4 <unfixed> (embed)
455 - tcl8.5 <unfixed> (embed)
456 NOTE: generic/tkImgGIF.c
457
458 tk8.5
459 - tk8.0 <removed> (old-version)
460 - tk8.3 <unfixed> (old-version)
461 - tk8.4 <unfixed> (old-version)
462 - perl-tk <unfixable> (fork)
463
464 samba
465 - mc <unfixed> (embed)
466 NOTE: maintainer is aware of this, currently searching a solution
467
468 plib1.8.4c2
469 - boson <unfixed> (fork)
470 NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
471
472 fribidi
473 - quesoglc <unfixed> (embed)
474
475 glew
476 - quesoglc <unfixed> (embed)
477
478 minorGems
479 - transcend <unfixed> (embed)
480 - cultivation <unfixed> (embed)
481
482 tar
483 - libarchive <unfixed> (embed)
484 NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
485
486 cpio
487 - libarchive <unfixed> (embed)
488 NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
489
490 webkit
491 - qt4-x11 <unfixed> (embed)
492
493 ftgl
494 - blender 2.46+dfsg-1 (embed)
495
496 wv
497 - abiword <unfixed>
498
499 qemu
500 - kvm <unfixed> (embed)
501 - xen-3 <unfixed> (embed)
502 - xen-unstable <unfixed> (embed)
503
504 bochs
505 - kvm <unfixed> (embed; bug #489442)
506
507 speex
508 - vorbis-tools <unfixed> (embed)
509 NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
510 - gst-plugins-good0.10 <unfixed> (embed)
511 - xine-lib <unfixed> (embed)
512 - libfishsound <unfixed> (embed)
513 - libannodex <unfixed> (embed)
514 - vlc <unfixed> (embed)
515 - xmms-speex <unfixed> (embed)
516 - libsdl-sound1.2 <unfixed> (embed)
517 - sweep <unfixed> (embed)
518
519 libreadline
520 - magic <unfixed> (old-version)
521 NOTE: magic is currently an RFS
522
523 opcode
524 - ode <unfixed> (embed)
525 NOTE: opcode is not a package in debian, it is just embedded
526 NOTE: http://www.codercorner.com/Opcode.htm
527
528 gimpact
529 - ode <unfixed> (embed)
530 NOTE: gimpact is not a package in debian, it is just embedded
531 NOTE: http://gimpact.sf.net
532
533 MochiKit.js
534 - mahara <unfixed> (embed)
535 - ntop <unfixed> (embed)
536 - python-oherence <unfixed> (embed)
537 - python-paste <unfixed> (embed)
538 - python-turbogears <unfixed> (embed)
539 - zope-plone3 <unfixed> (embed)
540
541 prototype.js
542 - netbeans-ide <unfixed> (embed)
543 - auth2db-frontend <unfixed> (embed)
544 - citadel-webcit <unfixed> (embed)
545 - asterisk <unfixed> (embed)
546 - doc-iana <unfixed> (embed)
547 - libaws-doc <unfixed> (embed)
548 - libgettext-ruby-data <unfixed> (embed)
549 - libjson-ruby-doc <unfixed> (embed)
550 - liblucene2-java-doc <unfixed> (embed)
551 - libopenid-ruby <unfixed> (embed)
552 - solr-common <unfixed> (embed)
553 - glpi <unfixed> (embed)
554 - hobbix <unfixed> (embed)
555 - mnemo2 <unfixed> (embed)
556 - nag2 <unfixed> (embed)
557 - libjs-prototype <unfixed> (embed)
558 - libjs-scriptaculous <unfixed> (embed)
559 - knowledgeroot <unfixed> (embed)
560 - mediatomb-common <unfixed> (embed)
561 - mt-daapd <unfixed> (embed)
562 - op-panel <unfixed> (embed)
563 - ebug-http <unfixed> (embed)
564 - phpgedview <removed> (embed)
565 - poker-web <unfixed> (embed)
566 - python-webhelpers <unfixed> (embed)
567 - qwik <unfixed> (embed)
568 - rails <unfixed> (embed)
569 - typo3-src-4.1 <unfixed> (embed)
570 - wordpress <unfixed> (embed)
571 - zope-plone3 <unfixed> (embed)
572 - smokeping <unfixed> (embed)
573
574 gdb
575 - insight <unfixed> (embed)
576
577 e2fsprogs
578 - ldiskfsprogs <unfixable> (fork)
579
580 quazip (not packaged in Debian)
581 - qcake <unfixed> (embed)
582 NOTE: starting with upstream version 0.6.4
583
584 exo
585 - pcmanfm <unfixed> (embed; bug #499677)
586 NOTE: slightly modified source code
587
588 java
589 - openjdk-6 <unfixed>
590 - sun-java5 <unfixed>
591 - sun-java6 <unfixed>
592
593 libphp-snoopy
594 - ampache <unfixed> (embed; bug #504169)
595 - mahara <unfixed> (embed; bug #504170)
596 - pixelpost <unfixed> (embed; bug #504171)
597 - mediamate <unfixed> (embed; bug #504172)
598 - opendb <unfixed> (embed; bug #504173)
599 - wordpress <unfixed> (embed; bug #443948)
600 - moodle <unfixed> (embed)

  ViewVC Help
Powered by ViewVC 1.1.5