/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Contents of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log


Revision 10232 - (show annotations) (download)
Sun Nov 2 05:51:19 2008 UTC (4 years, 6 months ago) by atomo64-guest
File size: 15739 byte(s)
Partially update the list of embedded js and php scripts with lintian's reports
1 Embedded code copies
2 ====================
3
4 This file collects source packages that embed code from other projects.
5 This is considered bad for fixing security flaws because the fix needs
6 to be applied in multiple source packages.
7
8 Format:
9 <srcpkg> (<optional comment about srcpkg>)
10 - <embedding srcpkg> <status> (<sort>; bug #<number>)
11 NOTE: optional comments about the linkage of the embedding srcpkg
12
13 status: version number fixing the embedded copy, <unfixed>, <removed>,
14 <itp> or <unknown> if the version number can not be determined
15 <unfixable> for unavoidable cases (e.g., forks that add real value)
16 sort: static (linking statically against a lib)
17 embed (embedding a copy of the library into another source package)
18 fork (the package is not just embedding code but it is a fork and
19 thus might share parts of the source code)
20 old-version (the package is an older version of essentially
21 the same code)
22
23 The srcpkg might be some string to identify the code if there is no
24 specific source package.
25
26 Everything up to the next line is ignored.
27 ---BEGIN
28 xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29 NOTE: Fixed packages link to poppler library unless otherwise noted
30 - gpdf <removed>
31 [sarge] - gpdf <unfixed>
32 NOTE: has been replaced by evince in etch
33 - pdftohtml <unknown>
34 [sarge] - pdftohtml <unfixed>
35 [etch] - pdftohtml <unfixed>
36 NOTE: has been replaced by poppler-utils
37 - kdegraphics <unfixed> (embed; bug #436164)
38 NOTE: the kpdf replacement in KDE 4 is using poppler
39 - texlive-base 3.0-12 (embed)
40 - texlive-bin 2007-1 (embed)
41 NOTE: links to poppler
42 - koffice <unfixed> (embed; bug #436163)
43 - libextractor 0.5.12-1 (embed)
44 NOTE: libextractor is using its own pdf decoder now
45 - libextractor 0.5.12-1 (embed)
46 - pdfkit.framework 0.8-4 (embed)
47 - ipe <unfixed> (embed)
48 NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
49 - ruby-gnome2 <unknown> (embed)
50 NOTE: copy only present in source but links to poppler
51
52 ppmd
53 - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
54
55 peercast
56 - gnome-peercast <unfixed> (embed)
57 NOTE: gnome-peercast may better be removed, see #466539
58
59 silc-toolkit
60 - silc-client 1.1~beta6-1 (embed)
61
62 dietlibc
63 - ccontrol 0.9.1+20071204-1 (static)
64
65 libiax
66 - iaxmodem <unfixed> (embed)
67
68 zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
69 - dpkg <unfixed> (embed)
70 NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
71 - rsync <unfixed> (embed)
72 NOTE: somehow derived code base
73 - mono <unfixed> (embed)
74 TODO: check mozilla
75 - Linux kernels <unfixed> (embed)
76 - pvpgn 1.7.8-2 (embed)
77 - mrtg 2.12.2-1 (embed)
78 - rpm <unknown> (embed)
79 NOTE: pinged anibal since when rpm was fixed
80
81 libbz2
82 - dpkg <unfixed> (static)
83
84 ekg
85 - centericq <unfixed> (embed)
86 - gaim <unfixed> (embed)
87 - pigdin <unfixed> (embed)(links dynamically against libgadu)
88 - kopete 4:3.3.2-5 (embed)
89 - kadu <unfixed> (embed)
90 - gadu <unfixed> (embed)
91 NOTE: g/kadu not packaged in Debian yet
92
93 xmlrpc (which package is the "origin" of this code?)
94 - drupal <unfixed> (embed)
95 - phpgroupware <unfixed> (embed)
96 - egroupware <unfixed> (embed)
97 - phpwiki (embed)
98 - php4 <unfixed> (embed)
99 TODO: check, php-pear, IIRC this was reorganized some weeks ago?
100
101 shtool (affects build-time only)
102 - mysql-ocaml <unfixed> (embed)
103 - php4 <unfixed> (embed)
104
105 mozilla source code
106 - mozilla-firefox <unfixed> (embed)
107 - mozilla-thunderbird
108 - firefox <removed>
109 [etch] - firefox <unfixed> (embed)
110 - thunderbird <removed>
111 [etch] - thunderbird <unfixed> (embed)
112 - iceweasel <unfixed> (embed)
113 - iceape <unfixed> (embed)
114 - icedove <unfixed> (embed)
115 - xulrunner <unfixed> (embed)
116 - nvu <removed> (embed)
117
118 xli
119 - xloadimage <unfixed> (embed)
120
121 lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
122 - openmotif <unfixed> (embed)
123 - xfree86/xorg <unfixed> (embed)
124 NOTE: in libxpm
125
126 kerberized apps with BSD origin
127 - krb4 <unfixed> (embed)
128 - krb5 <unfixed> (embed)
129 - heimdal <unfixed> (embed)
130
131 grip (which pkg is the origin?)
132 - libcdaudio
133 - grip
134 - gnome-vfs
135 TODO: check vfs2 as well
136
137 fudforum
138 - phpgroupware-fudforum <unfixed> (embed)
139 - egroupware-fudforum <removed>
140 [sarge] - egroupware-fudforum <unfixed> (embed)
141
142 cvs
143 - gcvs <unfixed> (embed)
144 NOTE: see cvsunix/src in tarball
145
146 pcre
147 - python* <unfixed> (embed)
148 - php4 <unknown> (embed)
149 - analog 2:5.23-0woody1 (embed)
150 - libgoffice-1 <unfixed> (embed)
151 - vfu 4.06-4.1 (embed; bug #450754)
152 - tf5 5.0beta7-1 (embed)
153 - monotone <unfixed> (embed)
154 NOTE: this only affects versions >= 0.37
155 - glib2.0 2.15.2-1 (embed)
156 - apache2 2.0.53-4 (embed)
157 - exim4 4.10-0.srh20.12 (embed)
158 - yacas <unfixed> (embed)
159 NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
160 - gtamsanalyzer.app 0.42-5 (embed)
161 - tin <unknown> (embed)
162 - kazehakase 0.5.2-1
163 - webkit <unfixed> (embed)
164 - qt4-x11 <unfixed> (embed)
165 NOTE: embedded via webkit copy
166
167 tiff
168 - wxwindows2.4 2.2.1 (embed)
169
170 uudeview
171 - libconvert-uulib-perl <unfixed> (embed)
172 - pan <unfixed> (embed)
173
174 sqlite (not affected by security vulnerabilities so far)
175 - amarok <unfixed> (embed)
176 - monotone <unfixed> (embed)
177 - iceweasel <unfixed> (embed)
178
179 util-linux/mount
180 - loop-aes-utils <unfixed> (embed)
181 NOTE: contains code from util-linux' mount in the mount-aes-udeb
182
183 webmin
184 - usermin <unknown> (embed)
185 [sarge] - usermin <unfixed> (embed)
186
187 sylpheed
188 - sylpheed-claws <unfixed> (fork)
189
190 phpsysinfo
191 - egroupware <unfixed> (embed)
192 - phpgroupware <unfixed> (embed)
193
194 phpldapadmin
195 [sarge] - egroupware <unfixed> (embed)
196 NOTE: removed from egroupware after sarge
197
198 chmlib
199 - kchmviewer <unknown> (embed)
200
201 libavcodec/libavformat (source: ffmpeg)
202 - mplayer 1.0~rc2-14 (embed; bug #395252)
203 - kino 1.0.0-1
204 - vlc <not-affected> (Links dynamically since initial release)
205 - smilutils 0.3.0-10
206 NOTE: smilutils likely fixed earlier, marking Etch's version as fixed
207 - motion 3.1.19-1
208 - gstreamer0.10-ffmpeg 0.10.3-2
209 - xmovie <unfixed>
210 TODO: gimp-gap (potentially using ffmpeg code as well)
211
212 mad MPEG decoding lib
213 - mad <unfixed> (embed)
214 - xine-lib <unfixed> (embed)
215
216 libdts
217 - xine-lib <unfixed> (embed)
218
219 flac
220 - xine-lib <unfixed> (embed)
221
222 liba52
223 - a52dec <unfixed> (embed)
224 - xine-lib <unfixed> (embed)
225
226 libmpeg2
227 - mpeg2dec <unfixed> (embed)
228 - xine-lib <unfixed> (embed)
229
230 curl
231 - wget <unfixed> (embed)
232 NOTE: code for NTLM authentication
233
234 uw-imap
235 - pine <unfixed> (embed)
236 - alpine <unfixed> (embed)
237
238 imagemagick
239 - graphicsmagick <unfixed> (fork)
240
241 libphp-snoopy
242 - ampache <unfixed> (embed)
243 - mahara <unfixed> (embed)
244 - pixelpost <unfixed> (embed)
245
246 halibut
247 - nsis <unfixed> (embed)
248
249 libghttp
250 - hotway <unfixed> (embed)
251
252 libsndfile
253 - ardour <unfixed> (embed)
254
255 glibmm2.4
256 - ardour <unfixed> (embed)
257
258 libgnomecanvasmm2.6
259 - ardour <unfixed> (embed)
260
261 libsigc++-2.0
262 - ardour <unfixed> (embed)
263
264 soundtouch
265 - ardour <unfixed> (embed)
266
267 libmms
268 - xine-lib <unfixed> (embed)
269 - mimms <unfixed> (embed)
270
271 fckeditor
272 - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
273 - moin <unfixed> (embed; bug #452599)
274 - karrigell <removed> (embed; bug #452598)
275 - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
276
277 ipatlas (not packaged in Debian)
278 - moodle <unfixed> (embed)
279
280 libphp-phpmailer
281 - moodle <unfixed> (embed)
282 - mahara <unfixed> (embed)
283 - symfony <unfixed> (embed)
284
285 htmlArea (not packaged in Debian)
286 - moodle <unfixed> (embed)
287
288 giflib:
289 - wine <unfixed> (embed; bug #466181)
290
291 bennu (not packaged in Debian)
292 - moodle <unfixed> (embed)
293
294 smarty:
295 - moodle <unfixed> (embed; bug #471158)
296 - gallery2 2.2.5-2 (embed; bug #471160)
297 - mahara 0.9.2-2 (embed; bug #471201)
298 - gosa 2.4beta1-1 (embed; bug #471200)
299
300 TinyMCE
301 - wordpress 2.5.1-3 (embed; bug #478257)
302 - moodle <unfixed> (embed)
303 - knowledgeroot <unfixed> (embed)
304 - joomla <itp> (bug #326398)
305
306 scintilla
307 - scite <unfixed> (embed)
308 - qscintilla <unfixed> (embed)
309 - qscintilla2 <unfixed> (embed)
310 - geany <unfixed> (embed)
311
312 libphp-adodb
313 - moodle <unfixed> (embed)
314 NOTE: also AdoDB-XML Schema
315 - gallery2 <unfixed> (embed)
316 - phppgadmin <unfixed> (embed)
317 - egroupware <unfixed> (embed)
318 - phpwiki <unfixed> (embed)
319 - ipplan <unfixed> (embed)
320 - typo3 <unfixed> (embed)
321 - moodle <unfixed> (embed)
322 - cacti <unknown> (embed)
323 [sarge] - cacti <unfixed> (embed)
324 NOTE: dependency exists, but internal version is used
325 - gforge <unfixed> (embed)
326 - mahara <unfixed> (embed)
327
328 gzip
329 - linux-kernel <unfixed> (embed)
330 NOTE: lib/inflate.c
331 - klibc <unfixed> (embed)
332 NOTE: based on linux-kernel gzip code
333 - busybox <unfixed> (embed)
334
335 neon
336 - cadaver <unfixed> (embed; bug #188381)
337 - gnome-vfs2 <unfixed> (embed; bug #395874)
338 - litmus <unfixed> (embed; #395875)
339 [sarge] - screem <unfixed> (embed)
340 - sitecopy <unfixed> (embed; bug #395876)
341 [etch] - tla <unfixed> (embed; bug #395877)
342 [sarge] - tla <unfixed> (embed; bug #395877)
343
344 libmodplug
345 - gst-plugins-bad0.10 <unfixed> (embed)
346
347 libvncserver
348 - vino <unfixed> (embed)
349
350 putty
351 - filezilla <unfixed> (embed)
352
353 tinyxml (not packaged in Debian)
354 - filezilla <unfixed>
355
356 gv
357 - evince <unfixed> (embed)
358 NOTE: ps/ tree from gv 3.5.8
359 - evince-gtk <unfixed> (embed)
360 NOTE: not packaged in Debian
361
362 libXbae
363 [etch] - libpawlib2-lesstif <unfixed> (embed)
364 NOTE: from Cernlib
365
366 libXaw
367 [etch] - libpawlib2-lesstif
368 NOTE: from Cernlib
369 NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
370
371 libgd2
372 - graphviz <unfixed> (embed)
373 NOTE: lib/gd seems to be 2.0.33
374 - wml <unfixed> (embed)
375 NOTE: derived from gd 1.6.3
376
377 rar
378 - unrar-nonfree <unfixed> (embed)
379
380 unrar-free (maybe this code is derived from the original rar, too?)
381 - clamav <unfixed> (embed)
382 NOTE: seems to be disabled in default config
383
384 mplayer (DirectMedia Object loader)
385 - xine-lib <unfixed> (embed)
386 NOTE: src/libw32dll/
387 - vlc <unfixed> (embed)
388 NOTE: modules/codec/dmo/
389
390 libwpd (WordPerfect converter)
391 - openoffice.org <unfixed> (embed)
392
393 fsplib (http://sourceforge.net/projects/fsp/)
394 - gftp <unfixed> (embed)
395 NOTE: lib/fsplib version 0.3
396
397 sprng
398 - tree-puzzle <unfixed> (embed)
399
400 librpcsecgss
401 - krb5 <unfixed> (embed)
402
403 jasper
404 - ghostscript <unfixed> (embed)
405 - gs-gpl <unfixed> (embed)
406
407 libidn
408 - monotone <unfixed> (embed)
409
410 liblua
411 - monotone <unfixed> (embed)
412
413 libbotan
414 - montone <unfixed> (embed)
415
416 NetXX
417 - monotone <unfixed> (embed)
418
419 libgc
420 - mono <unfixed> (embed)
421
422 lzma
423 - p7zip <unfixed> (embed)
424
425 lzo
426 - grub2 <unfixed> (embed)
427
428 yassl
429 - mysql-dfsg-5.0 <unfixed> (embed)
430
431 pax code
432 - tar <unfixed> (embed)
433 - cpio <unfixed> (embed)
434
435 t1lib
436 - tetex-bin 2.0.2-1 (embed)
437 - texlive-bin <unknown> (embed)
438
439 guichan
440 - boswars <unfixed> (embed)
441 NOTE: maintainer notified us, working on it
442
443 tolua
444 - boswars <unfixed> (embed)
445 NOTE: maintainer notified us, working on it
446
447 asio-dev
448 - luxrender <unfixed> (embed)
449 NOTE: maintainer notified us, working on it
450 NOTE: may be merged with boost "soon"
451
452 xine-lib
453 - vlc <unfixed> (embed)
454 NOTE: only parts included in modules/access/rtsp
455
456 netpbm
457 - tcl8.3 <unfixed> (embed)
458 - tcl8.4 <unfixed> (embed)
459 - tcl8.5 <unfixed> (embed)
460 NOTE: generic/tkImgGIF.c
461
462 tk8.5
463 - tk8.0 <removed> (old-version)
464 - tk8.3 <unfixed> (old-version)
465 - tk8.4 <unfixed> (old-version)
466 - perl-tk <unfixable> (fork)
467
468 samba
469 - mc <unfixed> (embed)
470 NOTE: maintainer is aware of this, currently searching a solution
471
472 plib1.8.4c2
473 - boson <unfixed> (fork)
474 NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
475
476 fribidi
477 - quesoglc <unfixed> (embed)
478
479 glew
480 - quesoglc <unfixed> (embed)
481
482 minorGems
483 - transcend <unfixed> (embed)
484 - cultivation <unfixed> (embed)
485
486 tar
487 - libarchive <unfixed> (embed)
488 NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
489
490 cpio
491 - libarchive <unfixed> (embed)
492 NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
493
494 webkit
495 - qt4-x11 <unfixed> (embed)
496
497 ftgl
498 - blender 2.46+dfsg-1 (embed)
499
500 wv
501 - abiword <unfixed>
502
503 qemu
504 - kvm <unfixed> (embed)
505 - xen-3 <unfixed> (embed)
506 - xen-unstable <unfixed> (embed)
507
508 bochs
509 - kvm <unfixed> (embed; bug #489442)
510
511 speex
512 - vorbis-tools <unfixed> (embed)
513 NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
514 - gst-plugins-good0.10 <unfixed> (embed)
515 - xine-lib <unfixed> (embed)
516 - libfishsound <unfixed> (embed)
517 - libannodex <unfixed> (embed)
518 - vlc <unfixed> (embed)
519 - xmms-speex <unfixed> (embed)
520 - libsdl-sound1.2 <unfixed> (embed)
521 - sweep <unfixed> (embed)
522
523 libreadline
524 - magic <unfixed> (old-version)
525 NOTE: magic is currently an RFS
526
527 opcode
528 - ode <unfixed> (embed)
529 NOTE: opcode is not a package in debian, it is just embedded
530 NOTE: http://www.codercorner.com/Opcode.htm
531
532 gimpact
533 - ode <unfixed> (embed)
534 NOTE: gimpact is not a package in debian, it is just embedded
535 NOTE: http://gimpact.sf.net
536
537 MochiKit.js
538 - mahara <unfixed> (embed)
539 NOTE: they require extra patches, still unmerged upstream
540 - ntop <unfixed> (embed)
541 - python-oherence <unfixed> (embed)
542 - python-paste <unfixed> (embed)
543 - python-turbogears <unfixed> (embed)
544 - zope-plone3 <unfixed> (embed)
545
546 prototype.js
547 - netbeans-ide <unfixed> (embed)
548 - auth2db-frontend <unfixed> (embed)
549 - citadel-webcit <unfixed> (embed)
550 - asterisk <unfixed> (embed)
551 - doc-iana <unfixed> (embed)
552 - libaws-doc <unfixed> (embed)
553 - libgettext-ruby-data <unfixed> (embed)
554 - libjson-ruby-doc <unfixed> (embed)
555 - liblucene2-java-doc <unfixed> (embed)
556 - libopenid-ruby <unfixed> (embed)
557 - solr-common <unfixed> (embed)
558 - glpi <unfixed> (embed)
559 - hobbix <unfixed> (embed)
560 - mnemo2 <unfixed> (embed)
561 - nag2 <unfixed> (embed)
562 - libjs-prototype <unfixed> (embed)
563 - libjs-scriptaculous <unfixed> (embed)
564 - knowledgeroot <unfixed> (embed)
565 - mediatomb-common <unfixed> (embed)
566 - mt-daapd <unfixed> (embed)
567 - op-panel <unfixed> (embed)
568 - ebug-http <unfixed> (embed)
569 - phpgedview <removed> (embed)
570 - poker-web <unfixed> (embed)
571 - python-webhelpers <unfixed> (embed)
572 - qwik <unfixed> (embed)
573 - rails <unfixed> (embed)
574 - typo3-src-4.1 <unfixed> (embed)
575 - wordpress <unfixed> (embed)
576 - zope-plone3 <unfixed> (embed)
577 - smokeping <unfixed> (embed)
578 - ampache <unfixed> (embed)
579 - exaile <unfixed> (embed)
580 - hobix <unfixed> (embed)
581 - pixelpost <unfixed> (embed)
582 - symfony <unfixed> (embed)
583 NOTE: it's been said that there are custom changes
584 - zabbix-frontend-php <unfixed> (embed)
585
586 gdb
587 - insight <unfixed> (embed)
588
589 e2fsprogs
590 - ldiskfsprogs <unfixable> (fork)
591
592 quazip (not packaged in Debian)
593 - qcake <unfixed> (embed)
594 NOTE: starting with upstream version 0.6.4
595
596 exo
597 - pcmanfm <unfixed> (embed; bug #499677)
598 NOTE: slightly modified source code
599
600 java
601 - openjdk-6 <unfixed>
602 - sun-java5 <unfixed>
603 - sun-java6 <unfixed>
604
605 libphp-snoopy
606 - ampache <unfixed> (embed; bug #504169)
607 - mahara <unfixed> (embed; bug #504170)
608 - pixelpost <unfixed> (embed; bug #504171)
609 - mediamate <unfixed> (embed; bug #504172)
610 - opendb <unfixed> (embed; bug #504173)
611 - wordpress <unfixed> (embed; bug #443948)
612 - moodle <unfixed> (embed)
613
614 jquery.js
615 - zekr <unfixed> (embed)
616
617 kses
618 - wordpress <unfixed> (embed; bug #504242)
619 NOTE: their copy has all methods renamed to wp_<foo>
620 - moodle <unfixed> (embed)
621 - egroupware-core <unfixed> (embed)
622
623 magpierss
624 - wordpress <unfixed> (embed; bug #504242)
625
626 php-gettext
627 - wordpress <unfixed> (embed; bug #504242)
628
629 libphp-ixr (name may change, it is the Incutio XML-RPC)
630 - wordpress <unfixed> (embed; bug #504242)
631 - dokuwiki <unfixed> (embed)
632 - textpattern <unfixed> (embed)

  ViewVC Help
Powered by ViewVC 1.1.5