/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Contents of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log


Revision 13967 - (show annotations) (download)
Sat Jan 30 03:59:29 2010 UTC (3 years, 4 months ago) by gilbert-guest
File size: 49530 byte(s)
re-add mysql notes; courier embeds maildrop
1 Embedded code copies
2 ====================
3
4 This file collects source packages that embed code from other projects.
5 This is considered bad for fixing security flaws because the fix needs
6 to be applied in multiple source packages.
7
8 Format:
9 <srcpkg> (<optional comment about srcpkg>)
10 - <embedding srcpkg> <status> (<sort>; bug #<number>)
11 NOTE: optional comments about the linkage of the embedding srcpkg
12
13 status: version number fixing the embedded copy, <unfixed>, <removed>,
14 <itp>, <not-affected>, <unknown> if the version number can not
15 be determined, or <unfixable> for unavoidable cases (e.g., forks
16 that add real value)
17 sort: static (linking statically against a lib)
18 embed (embeds a copy of the library into another source package)
19 modified-embed (embeds a code copy that differs from upstream code)
20 fork (a full-blown fork of another source package)
21 old-version (an older version of essentially the same code)
22
23 The srcpkg might be some string to identify the code if there is no
24 specific source package.
25
26 Everything up to the next line is ignored.
27 ---BEGIN
28 xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29 NOTE: Fixed packages link to poppler library unless otherwise noted
30 - pdftohtml <unknown>
31 [sarge] - pdftohtml <unfixed>
32 [etch] - pdftohtml <unfixed>
33 NOTE: has been replaced by poppler-utils
34 - kdegraphics 4:4.2.2-1 (embed; bug #436164)
35 - texlive-base 3.0-12 (embed)
36 - texlive-bin 2007-1 (embed)
37 NOTE: links to poppler
38 - koffice <unfixed> (embed; bug #436163)
39 - libextractor 0.5.12-1 (embed)
40 NOTE: libextractor is using its own pdf decoder now
41 - ipe <unfixed> (embed)
42 NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
43 - ruby-gnome2 <unknown> (embed)
44 NOTE: copy only present in source but links to poppler
45 - pdfedit <unfixed> (embed; bug #510794)
46 - swftools <unfixed> (embed; bug #551293)
47 - poppler <unfixable> (fork)
48
49 ppmd
50 - libcomplearn-mod-ppmd <unfixed> (fork)
51 NOTE: discussion in #458152
52
53 libevent
54 - transmission 1.71-1 (embed; bug #529372)
55
56 lrmi
57 - read-edid 2.0.0-1 (embed; bug #495131)
58 - s3switch <unfixed> (embed)
59 - xresprobe <unfixed> (embed)
60 - zhcon <unfixed> (embed)
61
62 peercast
63 - gnome-peercast <removed> (embed)
64 [etch] - gnome-peercast <unfixed> (embed)
65
66 silc-toolkit
67 - silc-client 1.1~beta6-1 (embed)
68
69 icclib
70 - ghostscript <unfixed> (embed)
71 - argyll <unfixed> (embed)
72
73 libusb
74 - argyll <unfixed> (embed)
75
76 dietlibc
77 - ccontrol 0.9.1+20071204-1 (static)
78
79 libmikmod
80 - sdl-mixer1.2 <unfixed> (embed)
81 TODO: report bug
82
83 libiax
84 - iaxmodem <unfixable> (embed; bug #548885)
85
86 spandsp
87 - iaxmodem <unfixable> (embed; bug #548885)
88
89 python-paramiko
90 - fabric 0.9.0-2 (embed; bug #561398)
91
92 zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
93 - dpkg <unfixed> (static)
94 NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
95 - rsync <unfixed> (embed)
96 - cherokee <unfixed> (embed)
97 NOTE: somehow derived code base
98 - mono <unfixed> (embed)
99 TODO: check mozilla
100 - Linux kernels <unfixed> (embed)
101 - pvpgn 1.7.8-2 (embed)
102 - mrtg 2.12.2-1 (embed)
103 - rpm <unknown> (embed)
104 NOTE: pinged anibal since when rpm was fixed
105 - tuxcmd-modules <unfixed> (embed)
106 - zsync <unfixed>
107 - tra <unfixed>
108 - sash <unfixed>
109 - nsis <unfixed>
110 - mseide-msegui <unfixed>
111 NOTE: mseide
112 - mirrordir <unfixed>
113 - poco <unfixed>
114 - klibc <unfixed>
115 - ghostscript <unfixed>
116 - freeimage <unfixed>
117 - clamav <unfixed> (fork)
118 NOTE: from the changelog: "libclamav6 does indeed duplicate parts of the zlib code, but there is not way around that"
119 - tuxonice-userui <unfixed>
120 - plt-scheme <unfixed>
121 - perl <unfixed>
122 - paraview <unfixed>
123 - velvet 0.7.56~nozlibcopy-1
124 - gcvs <unfixed>
125 - dump <unfixed>
126 - aide <unfixed> (static)
127 - dar <unfixed> (static)
128 - avfs <unfixed>
129 - fpc <unfixed>
130 - winff <unfixed>
131 NOTE: inherited from fpc, see #472304
132 - lazarus <unfixed>
133 NOTE: inherited from fpc, see #472304
134 - erlang <unfixed> (embed)
135 - gamera 3.2.3-1 (embed)
136 - python2.4 <unfixed> (embed; bug #553403)
137 - python2.5 <unfixed> (embed; bug #553403)
138
139 dulwich
140 - hg-git 0.1.0-1 (embed; bug #541996)
141
142 libvigraimpex
143 - hugin <unfixed> (embed; bug #542259)
144 - enblend-enfuse <unfixed> (embed; bug #542258)
145 - gamera 3.2.3-1 (embed)
146
147 libbz2
148 - dpkg <unfixed> (static)
149
150 libyahoo2
151 - centerim <unfixed> (embed; bug #559783)
152
153 libmsn
154 - centerim <unfixed> (embed; bug #559783)
155
156 libgadu
157 - centerim <unfixed> (embed; bug #559783)
158 - pidgin <not-affected> (links dynamically since initial release; fixed in gaim)
159 - gaim 1:2.0.0+beta3-3 (embed; bug #360280)
160 - kdenetwork 4:3.3.2-5 (embed)
161 NOTE: from kdenetwork: kopete
162 - ekg 1:1.8~rc0-1 (embed)
163 - kadu 0.6.0.2-3 (embed; bug #504430)
164 - gadu <itp> (embed)
165
166 xmlrpc (which package is the "origin" of this code?)
167 - drupal <unfixed> (embed)
168 - phpgroupware <unfixed> (embed)
169 - egroupware <unfixed> (embed)
170 - phpwiki <unfixed> (embed)
171 - php4 <unfixed> (embed)
172 TODO: check, php-pear, IIRC this was reorganized some weeks ago?
173
174 shtool (affects build-time only)
175 - mysql-ocaml <unfixed> (embed)
176 - php4 <unfixed> (embed)
177
178 xulrunner
179 - iceape <unfixed> (embed; bug #561749)
180 - iceweasel 2.0.0.19 (embed)
181 - icedove <unfixed> (embed; bug #561750)
182 - kompozer <unfixed> (embed; bug #532168)
183 - galeon 2.0.2-4 (embed)
184 - epiphany-browser 2.14.3-8 (embed)
185 - conkeror 0.9~git080629-2 (embed)
186 - kazehakase 0.4.2-1 (embed)
187
188 xli
189 - xloadimage <unfixed> (embed)
190
191 lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
192 - openmotif <unfixed> (embed)
193 - libxpm <unfixed> (embed)
194
195 kerberized apps with BSD origin
196 - krb4 <removed> (embed)
197 - krb5 <unfixed> (embed)
198 - heimdal <unfixed> (embed)
199
200 grip (which pkg is the origin?)
201 - libcdaudio <unfixed>
202 - grip <unfixed>
203 - gnome-vfs <unfixed>
204 TODO: check vfs2 as well
205
206 fudforum
207 [etch] - phpgroupware <unfixed> (embed)
208 NOTE: phpgroupware-fudforum
209 [sarge] - egroupware-fudforum <removed> (embed)
210
211 libbsd
212 - rdate 1:1.2-3 (embed)
213 - atheme-services <unfixed>
214 - libbsd-arc4random-perl <unfixed>
215 - isakmpd <unfixed>
216 - bsdgames <unfixed> (embed)
217 - bsd-mailx <unfixed> (embed)
218 - netcat-openbsd <unfixed> (embed; bug #550611)
219 - openssh <unfixed> (embed)
220 - unworkable <unfixed> (embed)
221
222 cvs
223 - gcvs <unfixed> (embed)
224 NOTE: see cvsunix/src in tarball
225
226 pcre3
227 - php4 <unknown> (embed)
228 - analog 2:5.23-0woody1 (embed)
229 - goffice <unfixed> (embed)
230 NOTE: libgoffice-*
231 - vfu 4.06-4.1 (embed; bug #450754)
232 - tf5 5.0beta7-1 (embed)
233 - monotone 0.43-1 (embed)
234 NOTE: this only affects versions >= 0.37
235 - glib2.0 2.15.2-1 (embed)
236 - apache2 2.0.53-4 (embed)
237 - exim4 4.10-0.srh20.12 (embed)
238 - yacas <unfixed> (embed)
239 NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
240 - gtamsanalyzer.app 0.42-5 (embed)
241 - tin 980117-1 (embed)
242 - kazehakase 0.5.2-1
243 - webkit 1.0.1-1 (embed)
244 - qt4-x11 <unfixed> (embed)
245 NOTE: embedded via webkit copy
246 - erlang <unfixed> (embed)
247 - ssed <unfixed> (embed)
248
249 tiff
250 - wxwindows2.4 2.2.1 (embed)
251 - gamera 3.2.3-1 (embed)
252
253 uudeview
254 - libconvert-uulib-perl <unfixed> (embed)
255 - pan <unfixed> (embed)
256
257 sqlite (not affected by security vulnerabilities so far)
258 - amarok <unfixed> (embed)
259 - monotone 0.43-1 (embed)
260 - iceweasel <unfixed> (embed)
261 - heimdal <unfixed> (embed; bug #559616)
262
263 util-linux/mount
264 - loop-aes-utils <unfixed> (embed)
265 NOTE: contains code from util-linux' mount in the mount-aes-udeb
266
267 sylpheed
268 - sylpheed-claws <unfixed> (fork)
269
270 phpsysinfo
271 - egroupware <unfixed> (embed)
272 - phpgroupware <unfixed> (embed)
273
274 phpldapadmin
275 [sarge] - egroupware <unfixed> (embed)
276 NOTE: removed from egroupware after sarge
277
278 chmlib
279 - kchmviewer <unknown> (embed)
280
281 ffmpeg (libavcodec/libavformat)
282 - mplayer 1.0~rc2-14 (embed; bug #395252)
283 - kino 1.0.0-1
284 - vlc <not-affected> (Links dynamically since initial release)
285 - smilutils 0.3.0-10
286 NOTE: smilutils likely fixed earlier, marking Etch's version as fixed
287 - motion 3.1.19-1
288 - gstreamer0.10-ffmpeg 0.10.3-2
289 - xmovie <removed> (static)
290 TODO: gimp-gap (potentially using ffmpeg code as well)
291 - avifile 1:0.7.48~20090503.ds-1 (embed; bug #538750)
292 - audacity 1.3.7-2 (embed; bug #512278)
293
294 faad2
295 - mplayer 1.0~rc2-20 (embed)
296 - avifile <unfixed> (embed; bug #538750)
297 - ffmpeg-debian <removed> (old-version)
298
299 libmad (MPEG decoding lib)
300 - xine-lib <unfixed> (embed)
301 - avifile 1:0.7.48~20090503.ds-1 (embed) [./plugins/libmad/*]
302 TODO: check ocaml-mad, madplay, pymad, xmms-mad, xmms2
303
304 libdts
305 - xine-lib <unfixed> (embed)
306
307 flac
308 - xine-lib <unfixed> (embed)
309
310 liba52
311 - a52dec <unfixed> (embed)
312 - xine-lib <unfixed> (embed)
313
314 libmpeg2
315 - mpeg2dec <unfixed> (embed)
316 - xine-lib <unfixed> (embed)
317
318 libntlm
319 - wget <unfixed> (fork; bug #550436)
320 - curl <unfixed> (fork; bug #550437)
321 - cntlm <unfixed> (fork; bug #550438)
322
323 uw-imap
324 - pine <unfixed> (embed)
325 - alpine <unfixed> (embed)
326
327 imagemagick
328 - graphicsmagick <unfixed> (fork)
329
330 python-urlgrabber
331 - mercurial <unfixed> (embed; bug #531062)
332 - w3af <unfixed> (embed; bug #555372)
333 [experimental] - harvestman <unfixed> (embed; bug #555373)
334
335 beautifulsoup
336 - python-mechanize <unfixed> (embed; bug #555349)
337 - zope2.11 <removed> (embed; bug #555350)
338 - twill <unknown> (embed)
339
340 halibut
341 - nsis <unfixed> (fork)
342
343 libghttp
344 - hotway <unfixed> (embed)
345
346 libsndfile
347 - ardour 1:2.7.1-1 (embed)
348
349 glibmm2.4
350 - ardour 1:2.7.1-1 (embed)
351
352 libgnomecanvasmm2.6
353 - ardour 1:2.7.1-1 (embed)
354
355 libsigc++-2.0
356 - ardour 1:2.7.1-1 (embed)
357
358 soundtouch
359 - ardour 1:2.7.1-1 (embed)
360
361 libmms
362 - xine-lib <unfixed> (embed)
363 - mimms <unfixed> (embed)
364
365 fckeditor
366 - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
367 - moin 1.8.2-2 (embed; bug #452599)
368 - karrigell <removed> (embed; bug #452598)
369 - gforge 4.6.99+svn6225-1 (embed)
370 - request-tracker3.8 <unfixed> (embed)
371 - otrs2 <unfixed> (embed)
372
373 ipatlas (not packaged in Debian)
374 - moodle <unfixed> (embed; bug #507185)
375
376 libphp-phpmailer
377 - moodle <unfixed> (embed; bug #507185)
378 - mahara <unfixed> (embed)
379 - symfony <unfixed> (embed; bug #566778)
380 [etch] - phpgroupware <unfixed> (embed)
381 NOTE: phpgroupware-felamimail is only in etch
382 - egroupware <unfixed> (embed; bug #504283)
383 - glpi <unfixed>
384
385 htmlArea (not packaged in Debian)
386 - moodle <unfixed> (embed)
387
388 giflib
389 - wine <unfixed> (embed; bug #466181)
390
391 bennu (not packaged in Debian, http://bennu.sourceforge.net)
392 - moodle <unfixed> (embed)
393
394 smarty
395 - moodle 1.8.2-2 (embed; bug #471158)
396 - gallery2 2.2.5-2 (embed; bug #471160)
397 - mahara 0.9.2-2 (embed; bug #471201)
398 - gosa 2.4beta1-1 (embed; bug #471200)
399
400 TinyMCE
401 - wordpress 2.5.1-3 (embed; bug #478257)
402 - moodle <unfixed> (embed; bug #507185)
403 - knowledgeroot <unfixed> (embed)
404 - joomla <itp> (bug #326398)
405
406 scintilla (upstream provides static lib, rejected shared lib http://sf.net/support/tracker.php?aid=2488121)
407 - scite <unfixed> (embed)
408 - qscintilla <unfixed> (embed)
409 - qscintilla2 <unfixed> (embed)
410 - geany <unfixed> (fork)
411 - anjuta <unfixed> (embed)
412
413 libphp-adodb
414 - moodle <unfixed> (embed; bug #507185)
415 NOTE: also AdoDB-XML Schema
416 - gallery2 <unfixed> (embed)
417 - phppgadmin <unfixed> (embed)
418 - egroupware <unfixed> (embed)
419 - phpwiki <unfixed> (embed)
420 - torrentflux 2.0beta1-2 (embed)
421 - ipplan <unfixed> (embed)
422 - typo3-src <unfixed> (embed)
423 - cacti <unknown> (embed)
424 [sarge] - cacti <unfixed> (embed)
425 NOTE: dependency exists, but internal version is used
426 - gforge 4.7~rc2-6 (embed)
427 - mahara <unfixed> (embed)
428
429 gzip
430 - linux-kernel <unfixed> (embed)
431 NOTE: lib/inflate.c
432 - klibc <unfixed> (embed)
433 NOTE: based on linux-kernel gzip code
434 - busybox <unfixed> (embed)
435 - pristine-tar <unfixed> (modified-embed)
436 NOTE: compression code only, not uncompression
437
438 neon
439 - cadaver 0.22.3+debian-1 (embed; bug #188381)
440 - gnome-vfs2 <unfixed> (embed; bug #395874)
441 [etch] - litmus <unfixed> (embed; #395875)
442 - litmus <removed> (embed; #395875)
443 [sarge] - screem <unfixed> (embed)
444 - sitecopy 1:0.16.0-1 (embed; bug #395876)
445 [etch] - tla <unfixed> (embed; bug #395877)
446 [sarge] - tla <unfixed> (embed; bug #395877)
447
448 libmodplug
449 - gst-plugins-bad0.10 <unfixed> (embed)
450
451 libvncserver
452 - vino <unfixed> (embed)
453
454 putty
455 - filezilla <unfixed> (embed)
456
457 tinyxml (not packaged in Debian; itp bug #531968)
458 - filezilla <unfixed>
459 - crystalspace <unfixed> (embed)
460 - libwfut <unfixed> (embed)
461 - rarian <unfixed> (embed)
462 - bulletml <unfixed> (embed)
463 - pokerth <unfixed> (embed)
464 - qutecom <unfixed> (embed)
465 - sofa-framework <unfixed> (embed)
466 - yate <unfixed> (embed)
467 - antigrav <unfixed> (embed)
468 - balder2d <unfixed> (embed)
469 - cal3d <unfixed> (embed)
470 - criticalmass <unfixed> (embed)
471 - ember <unfixed> (embed)
472 - epiphany <unfixed> (embed)
473 - gambit <unfixed> (embed)
474 - noiz2sa <unfixed> (embed)
475 - ogre <unfixed> (embed)
476 - opencity <unfixed> (embed)
477 - openmovieeditor <unfixed> (embed)
478 - pouetchess <unfixed> (embed)
479 - tecnoballz <unfixed> (embed)
480 - trigger-rally <unfixed> (embed)
481 - xmoto <unfixed> (embed)
482 - mapnik <unknown> (embed)
483 NOTE: uses a different XML parser by default
484 - rrootage 0.23a-6 <embed>
485 NOTE: links to libbulltetml
486 - boson <unknown> (embed)
487 NOTE: the embedded code is unused
488
489 gv
490 - evince <unfixed> (embed)
491 NOTE: ps/ tree from gv 3.5.8
492 NOTE: evince-gtk is affected (a component of evince source package)
493
494 libXbae
495 - paw <removed> (embed)
496 [etch] - paw <unfixed> (embed)
497
498 libgtkhtml
499 - claws-mail-extra-plugins <unfixed> (fork)
500
501 libXaw
502 - paw <removed> (embed)
503 [etch] - paw <unfixed> (embed)
504 NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
505
506 libgd2
507 - graphviz <unfixed> (embed)
508 NOTE: lib/gd seems to be 2.0.33
509 - wml <unfixed> (embed)
510 - libwmf <unfixed> (embed)
511 NOTE: derived from gd 1.6.3
512
513 rar
514 - unrar-nonfree <unfixed> (embed)
515
516 unrar-free (maybe this code is derived from the original rar, too?)
517 - clamav <unfixed> (embed)
518 NOTE: seems to be disabled in default config
519
520 mplayer (DirectMedia Object loader)
521 - xine-lib <unfixed> (embed)
522 NOTE: src/libw32dll/
523 - vlc <unfixed> (embed)
524 NOTE: modules/codec/dmo/
525 - mplayer 1.0~rc2-20 (embed)
526
527 libwpd (WordPerfect converter)
528 - openoffice.org <unfixed> (embed)
529
530 fsplib (http://sourceforge.net/projects/fsp/)
531 - gftp <unfixed> (embed)
532 NOTE: lib/fsplib version 0.3
533
534 sprng
535 - tree-puzzle <unfixed> (embed)
536
537 librpcsecgss
538 - krb5 <unfixed> (embed)
539
540 jasper
541 - ghostscript 8.64~dfsg-2 (embed)
542
543 libiris
544 - psi <unfixed> (embed)
545 - kdenetwork <unfixed> (embed)
546 NOTE: kopete embeds libiris but links dynamically to libidn
547 - kdegames <unfixed> (embed)
548 NOTE: ksirk/kde4
549
550 libidn
551 - monotone 0.43-1 (embed)
552 - psi <unfixed> (embed)
553 NOTE: psi embeds libiris which embeds libidn
554 - kdegames <unfixed> (embed)
555 NOTE: kdegames/kde4 embeds libiris which embeds libidn
556
557 lua5.1
558 - monotone 0.43-1 (embed)
559 - nmap 5.00-1 (embed; bug #527997)
560 [lenny] - nmap <unfixed> (embed; bug #527997)
561 - ocropus <unfixed> (embed)
562 - enigma <unfixed> (embed)
563 NOTE: requires lua built with C++
564 - freeciv <unfixed> (embed)
565 - spring <unfixed> (embed)
566
567 libbotan
568 - monotone 0.43-1 (embed)
569
570 NetXX
571 - monotone 0.43-1 (embed)
572
573 libgc
574 - mono <unfixed> (embed)
575
576 lzma
577 - p7zip <unfixed> (embed)
578 - xz-utils <unfixed> (fork)
579
580 lzo
581 - grub2 <unfixed> (embed)
582
583 yassl
584 - mysql-dfsg-5.0 <unfixed> (embed)
585 - mysql-dfsg-5.1 <unfixed> (embed)
586
587 pax code
588 - tar <unfixed> (embed)
589 - cpio <unfixed> (embed)
590
591 t1lib
592 - tetex-bin 2.0.2-1 (embed)
593 - texlive-bin <unknown> (embed)
594
595 guichan
596 - boswars <unfixed> (embed)
597 NOTE: maintainer notified us, working on it
598
599 tolua
600 - boswars <unfixed> (embed)
601 NOTE: maintainer notified us, working on it
602 NOTE: actually tolua++
603 - ocropus <unfixed> (embed)
604 NOTE: actually tolua++
605 - freeciv <unfixed> (embed)
606 NOTE: actually tolua++
607 - enigma <unfixed> (embed)
608
609 asio-dev
610 - luxrender <removed> (embed)
611
612 xine-lib
613 - vlc <unfixed> (embed)
614 NOTE: only parts included in modules/access/rtsp
615
616 netpbm
617 - tcl8.3 <unfixed> (embed)
618 - tcl8.4 <unfixed> (embed)
619 - tcl8.5 <unfixed> (embed)
620 NOTE: generic/tkImgGIF.c
621
622 tk8.5
623 - tk8.0 <removed> (old-version)
624 - tk8.3 <unfixed> (old-version)
625 - tk8.4 <unfixed> (old-version)
626 - perl-tk <unfixable> (fork)
627
628 samba
629 - mc 2:4.6.2~git20080311-1 (embed)
630 NOTE: maintainer is aware of this, currently searching a solution
631
632 plib1.8.4c2
633 - boson <unfixed> (fork)
634 NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
635
636 fribidi
637 - quesoglc <unfixed> (embed)
638 NOTE: compiled against system fribidi in Debian - embed only used when fribidi is not available on the system
639
640 glew
641 - quesoglc <unfixed> (embed; bug #489341)
642 NOTE: waiting on GLEW_MX version of glew (see bug #474488)
643 - trigger <unfixed> (embed)
644 NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
645 - trigger-rally <unfixed> (embed)
646 NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
647
648 minorGems (pabs contacted upstream about shared lib, he considers minorGems an 'ever-evolving collection of reusable code fragments' for his own use)
649 - transcend <unfixed> (embed)
650 - cultivation <unfixed> (embed)
651 - passage <unfixed> (embed)
652 - gravitation <unfixed> (embed)
653
654 tar
655 - libarchive <unfixed> (embed)
656 NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
657
658 cpio
659 - libarchive <unfixed> (embed)
660 NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
661
662 kde4libs
663 - kdelibs <unfixable> (old-version)
664
665 webkit
666 - qt4-x11 <unfixed> (embed; bug #479851)
667 [etch] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
668 [lenny] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
669 - kde4libs <unfixable> (fork)
670 NOTE: kde4lib's khtml and webkit were forked from khtml (this tracking, which seems
671 NOTE: reversed genesis-wise, is used because of so much other stuff in kde4libs)
672
673 ftgl
674 - blender 2.46+dfsg-1 (embed)
675
676 wv
677 - abiword <unfixed>
678
679 qemu
680 - kvm <unfixed> (embed; bug #543159)
681 NOTE: the kvm package will be removed from sid and squeeze soon (after
682 NOTE: which it will only be in experimental). superceded by qemu-kvm.
683 - qemu-kvm <unfixed> (embed; bug #560853)
684 - xen-3 3.4.2-2 (embed; bug #560856)
685 - xen-unstable <unfixed> (embed; bug #560856)
686
687 vgabios
688 - kvm <unfixed> (embed; bug #489442)
689
690 bochs
691 - kvm <unfixed> (embed; bug #489442)
692
693 speex
694 - vorbis-tools <unfixed> (embed)
695 NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
696 - gst-plugins-good0.10 <unfixed> (embed)
697 - xine-lib <unfixed> (embed)
698 - libfishsound <unfixed> (embed)
699 - libannodex <removed> (embed)
700 - vlc <unfixed> (embed)
701 - xmms-speex <unfixed> (embed)
702 - libsdl-sound1.2 <unfixed> (embed)
703 - sweep <unfixed> (embed)
704
705 libreadline
706 - magic <itp> (old-version)
707
708 opcode
709 - ode <unfixed> (embed)
710 NOTE: opcode is not a package in debian, it is just embedded
711 NOTE: http://www.codercorner.com/Opcode.htm
712
713 gimpact
714 - ode <unfixed> (embed)
715 NOTE: gimpact is not a package in debian, it is just embedded
716 NOTE: http://gimpact.sf.net
717
718 mochikit
719 - mahara <unfixed> (embed)
720 NOTE: they require extra patches, still unmerged upstream
721 - ntop <unfixed> (embed)
722 - coherence 0.6.2-1 (embed)
723 - paste <unfixed> (embed)
724 - turbogears <unfixed> (embed)
725 - plone3 <removed> (embed)
726 - xulrunner <unfixed> (embed)
727 - libjifty-plugin-chart-perl <unfixed> (embed)
728 - sabnzbdplus <unfixed> (embed)
729 - tgmochikit <unfixed> (embed)
730
731 prototypejs
732 - netbeans-ide 6.0.1+dfsg-2 (embed)
733 - auth2db 0.2.5-2+dfsg-1 (embed; bug #555218)
734 - webcit <unfixed> (embed; bug #555219)
735 - asterisk 1:1.6.2.0~rc3-1 (embed)
736 - libjson-ruby 1.1.4-1 (embed; bug #555224)
737 - lucene2 2.9.1+ds1-2 (embed; bug #555226)
738 - horde3 <unfixed> (embed)
739 - knowledgeroot 0.9.9.5-1 (embed; bug #555230)
740 - mediatomb <unfixed> (embed; bug #555233)
741 - mt-daapd 0.9~r1696.dfsg-6lenny2 (embed)
742 - ebug-http <removed> (embed; bug #555236)
743 - libaws 2.7-1 (embed; bug #555222)
744 - phpgedview <removed> (embed)
745 - poker-network 1.7.6-1 (embed; bug #555238)
746 - rails 2.1.0-6 (embed)
747 - wordpress 2.5.0-2 (embed; bug #555243)
748 - zope <not-affected> (the prototypejs embed is not in any of the obvious zope packages, e.g. zope2.9, zope2.10, zope2.11, and zope3)
749 TODO: search through all of the other zope packages
750 - ampache 3.4.1-2 (embed)
751 - exaile 0.2.14+debian-2.1 (embed; bug #555245)
752 - hobix 0.5~svn20070319-4 (embed; bug #555247)
753 - zabbix 1.6.6-4 (embed; bug #555250)
754 - chora2 <unfixed> (embed; bug #555253)
755 - gollem <unfixed> (embed; bug # 555254)
756 - jscropperui 1.2.1-1 (embed; bug #555257)
757 - scriptaculous <not-affected> (uses system prototype.js since initial upload; bug #555260)
758 - ingo1 1.2.3+debian0-1 (embed; bug #555261)
759 - kronolith2 2.3.3+debian0-1 (embed; bug #555262)
760 - activeldap <unfixed> (embed)
761 - libv8 <not-affected> (contains a google-specific implementation of prototype.js)
762 - mantis 1.1.2+dfsg-1 (embed; bug #555265)
763 - otrs2 2.3.4-6 (embed; bug #555267)
764 - webcalendar 1.2~b1-2 (embed; bug #555269)
765 - redmine 0.9.0~svn2907-1 (embed; bug #555270)
766 - jifty 0.90519-1 (embed; bug #555271)
767 - jquery 1.4-1 (embed; bug #555272)
768 - passenger 2.2.5debian1-1 (embed; bug #555273)
769 - plone3 <removed> (embed; bug #555275)
770 - wesnoth <not-affected> (prototype.js not included in any of the binary packages; bug #555277)
771 - libhtml-prototype-perl 1.48-3 (embed; bug #538920)
772 - xulrunner <unfixed> (embed)
773 NOTE: included in iceweasel/xulrunner unit tests directory, so may not be security-relevant
774
775 gdb
776 - insight <unfixed> (embed)
777
778 e2fsprogs
779 - ldiskfsprogs <unfixable> (fork)
780
781 quazip (not packaged in Debian)
782 - qcake <unfixed> (embed)
783 NOTE: starting with upstream version 0.6.4
784
785 exo
786 - pcmanfm <unfixed> (embed; bug #499677)
787 NOTE: slightly modified source code
788
789 java
790 - openjdk-6 <unfixed>
791 - sun-java5 <unfixed>
792 - sun-java6 <unfixed>
793
794 libphp-snoopy
795 - ampache 3.4.1-2 (embed; bug #504169)
796 - gforge 4.6.99+svn6094-2 (embed)
797 - mahara 1.0.5-2 (embed; bug #504170)
798 - pixelpost 1.7.1-5 (embed; bug #504171)
799 - mediamate 0.9.3.6-5 (embed; bug #504172)
800 - opendb <removed> (embed; bug #504173)
801 [etch] - opendb <unfixed> (embed; bug #504173)
802 - wordpress 2.5.1-9 (embed; bug #443948)
803 - moodle <unfixed> (embed; bug #507185)
804 [etch] - phpgroupware <unfixed> (embed)
805 NOTE: phpgroupware-felamimail
806 - magpierss 0.72-3 (embed; bug #431089)
807
808 jquery
809 - zekr <unfixed> (embed)
810 - wordpress <unknown> (embed)
811 - yocto-reader <unfixed> (embed)
812 - textpattern <unfixed> (embed)
813 - genshi 0.5.1-1 (embed)
814 NOTE: compressed file under examples/ dir
815 - prewikka <unfixed> (embed)
816 - libramaze-ruby <unfixed> (embed)
817 - drupal5 <unfixed> (embed)
818 - b2evolution <unfixed> (embed)
819 - wesnoth <unfixed> (embed)
820
821 tablesorter (jquery plugin, not packaged yet)
822 - wesnoth <unfixed> (embed)
823
824 kses
825 - wordpress <unfixed> (embed; bug #504242)
826 NOTE: their copy has all methods renamed to wp_<foo>
827 NOTE: kses isn't in Debian, RFP: #504240
828 - moodle <unfixed> (embed; bug #507185)
829 - egroupware <unfixed> (embed)
830
831 magpierss
832 - wordpress <unfixed> (embed; bug #504242)
833 - moodle <unfixed>
834
835 php-gettext
836 - wordpress 2.8.4-1 (embed; bug #504242)
837 - docbookwiki <unfixed> (embed)
838 - knowledgeroot 0.9.9.5-1
839 NOTE: non-free
840
841 libphp-ixr (name may change, it is the Incutio XML-RPC)
842 - wordpress <unfixed> (embed; bug #504242)
843 NOTE: libphp-ixr isn't in Debian, RFP: #504236
844 - dokuwiki <unfixed> (embed)
845 - textpattern <unfixed> (embed)
846
847 libphp-cas
848 - glpi <unfixed> (embed)
849 - moodle <unfixed> (embed; bug #505984)
850
851 scriptaculous (prototype.js is among the embeds in the following)
852 - glpi <unfixed> (embed)
853 - libaws <unfixed> (embed; bug #555222)
854 - op-panel <unfixed> (embed)
855 - symfony <unfixed> (embed)
856 NOTE: maintainer says there are extra incompatible changes required
857 - pixelpost 1.7.1-6 (embed)
858 - webhelpers <unfixed> (embed)
859 - qwik <removed> (embed; bug #555241)
860 - smokeping <unfixed> (embed)
861 - turba2 <unfixed> (embed)
862 - typo3-src 4.2.3-1 (embed)
863 - request-tracker3.6 <unfixed> (embed)
864 - request-tracker3.8 <unfixed> (embed)
865 - rt-extension-emailcompletion <not-affected> (prototype.js not included in the binary package)
866 - wordpress 2.5.0-2 (embed)
867 - libhtml-prototype-perl 1.48-3 (embed)
868
869 libmarkdown-php
870 - moodle <unfixed> (embed; bug #507185)
871 - pixelpost 1.7.1-6 (embed)
872
873 php-openid
874 - wordpress-openid <itp> (embed)
875
876 geshi
877 - dokuwiki 0.0.20080505-3.1 (embed)
878 - pgfouine 1.0-1.1 (embed)
879 - websvn 2.1.0-1 (embed)
880
881 webcalendar
882 - gforge 4.7~rc2-6 (embed; bug #504758)
883
884 libical
885 - kdepim <unknown> (fork)
886 NOTE: fixed at some point during 4.0
887 - kdepimlibs 4.2.0-1 (fork)
888 - claws-mail-extra-plugins <unfixed> (fork)
889
890 harfbuzz
891 - qt4-x11 <unfixed> (embed)
892 - pango1.0 <unfixed> (embed)
893 - fontmatrix <unfixed> (embed)
894
895 libzip
896 - php5 <unfixable> (modified-embed)
897 - odt2txt <unfixed> (embed; bug #523808)
898
899 json.php (not packaged; should be replaced with php's built-in functions)
900 - moodle <unfixed>
901 - yui <unfixed>
902 - gallery2 <unfixed>
903 - dokuwiki <unfixed>
904 - typo3-src <unfixed>
905
906 php-fpdf
907 - tcpdf <itp> (fork)
908 - moodle <unfixed>
909 - phpwiki <unfixed>
910 - egroupware <unfixed>
911 - ldap-account-manager <unfixed> (fork)
912
913 tcpdf (itp: #495985)
914 - moodle <unfixed>
915 - phpmyadmin <unfixed>
916
917 typo3
918 - moodle <unfixed>
919
920 spreadsheet_writeexcel (PHP port of libspreadsheet-writeexcel-perl; itp: #487557)
921 - moodle <unfixed>
922 - gosa <unfixed>
923
924 php-ole (itp: #487558)
925 - moodle <unfixed>
926
927 pieforms (http://www.catalyst.net.nz)
928 - mahara <unfixed>
929
930 savant2 (http://phpsavant.com)
931 - egroupware <unfixed>
932
933 rssparser (http://nwow.org)
934 - egroupware <unfixed>
935 - phpgroupware <unfixed>
936
937 lcms
938 - openjdk-6 <unfixed> (fork)
939
940 libphp-phplayersmenu
941 - diogenes <unfixed>
942 - phpldapadmin <unfixed>
943
944 libphp-pclzip
945 - docvert <unfixed>
946 - moodle <unfixed>
947 - egroupware <unfixed>
948
949 libphp-simplepie
950 - dokuwiki <unfixed>
951 - wordpress <unfixed>
952
953 libphp-jpgraph
954 - egroupware <unfixed>
955
956 php-simpletest
957 - moodle <unfixed>
958
959 libpng
960 - iceweasel <not-affected> (uses xulrunner)
961 - icedove 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1, 2.0.0.19-1 (embed)
962 - iceape 1.0.13~pre080614i-0etch1 (embed)
963 - xulrunner 1.9.0.13-1 (embed)
964 [lenny] - xulrunner 1.9.0.11-0lenny1
965 [etch] - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
966 - gamera 3.2.3-1 (embed)
967
968 irssi
969 - silc-client <unfixed> (embed)
970 NOTE: Seems to be a pre-0.8.12 version that is used in irssi-plugin-silc
971
972 extc
973 - mtasc <unfixed> (embed)
974 - haxe <unfixed> (embed)
975
976 swflib
977 - mtasc <unfixed> (embed)
978 - haxe <unfixed> (embed)
979
980 libitext-java
981 - bouncycastle 2.1.4-1 (embed)
982
983 python-ply
984 - pyke <unfixed> (embed; bug #555363)
985 - pywbem 0.7.0-4 (embed; bug #555364)
986 - sepolgen <unfixed> (embed; bug #555365)
987 - zope-textindexng3 <unknown> (embed)
988 - iceweasel <not-affected> (uses xulrunner)
989 - xulrunner <unknown> (embed)
990 - wireshark <not-affected> (python-ply modules are not installed into binary packages; see #554613)
991
992 libdumbnet (libdnet upstream)
993 - nmap <unfixed> (fork)
994
995 gcc-4.4
996 - gcc-mingw32 <unfixed> (embed)
997
998 camlimages
999 - advi <unfixed> (static; bug #550441)
1000
1001 memcached
1002 - memcachedb <unfixed> (embed)
1003
1004 yajl
1005 - argyll <unfixed> (embed; bug #544223)
1006 NOTE: reference, confirmed by build logs: http://lists.debian.org/debian-mentors/2009/08/msg00062.html
1007
1008 nusoap
1009 - gforge 4.8.2-1 (embed)
1010 - ampache <unfixed> (embed)
1011 - poker-network <unfixed> (old-version)
1012 - moodle <unfixed> (old-version)
1013 NOTE: code is not used when running under php5 and soap is enabled
1014 - phpwiki <unfixed> (old-version)
1015 - gallery2 <unfixed> (old-version)
1016 - typo3-src <unfixed> (old-version)
1017
1018 libept
1019 - adept <unfixed> (embed; bug #540649)
1020
1021 libvorbis
1022 - iceweasel <not-affected> (uses xulrunner)
1023 - xulrunner <unfixed> (embed; bug #540959)
1024 [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1025 [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1026 - iceape <unfixed> (embed)
1027 [etch] - iceape <not-affected> (introduced in 2.0)
1028 [lenny] - iceape <not-affected> (introduced in 2.0)
1029
1030 cairo
1031 - iceweasel <not-affected> (uses xulrunner)
1032 - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
1033
1034 liboggz
1035 - iceweasel <not-affected> (uses xulrunner)
1036 - xulrunner <unfixed> (embed; bug #540959)
1037 [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1038 [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1039 - iceape <unfixed> (embed)
1040 [etch] - iceape <not-affected> (introduced in 2.0)
1041 [lenny] - iceape <not-affected> (introduced in 2.0)
1042
1043 liboggplay
1044 - iceweasel <not-affected> (uses xulrunner)
1045 - xulrunner <unfixed> (embed; bug #540959)
1046 [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1047 [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1048 - iceape <unfixed> (embed)
1049 [etch] - iceape <not-affected> (introduced in 2.0)
1050 [lenny] - iceape <not-affected> (introduced in 2.0)
1051
1052 php-net-dnsbl
1053 - serendipity <unfixed> (embed; bug #541740)
1054
1055 php-onyx-rss
1056 - serendipity <unfixed> (embed; bug #541740)
1057
1058 php-text-wiki
1059 - serendipity <unfixed> (embed; bug #541740)
1060
1061 php-xml-rpc
1062 - serendipity <unfixed> (embed; bug #541740)
1063
1064 polarssl (does not have a shared library)
1065 - pdkim <itp> (embed; bug #543150)
1066 - xyssl <unfixed> (old-version)
1067
1068 pidgin
1069 - gaim <removed> (old-version)
1070 - qutecom <unfixed> (embed; bug #559785)
1071
1072 icu
1073 - webkit 1.0.1-1 (embed; bug #547214)
1074 - texlive-bin <unfixed> (fork)
1075 NOTE: texlive upstream working with icu upstream to merge their changes
1076
1077 cyrus-imapd-2.2
1078 - kolab-cyrus-imapd <unfixed> (fork)
1079 - dovecot 1:1.2.1-1 (embed) [/dovecot-sieve/src/libsieve/*]
1080
1081 python-cxx-dev
1082 - freecad 0.9.2646.3-1 (embed; bug #547936)
1083
1084 zipios++
1085 - freecad 0.9.2646.3-1 (embed; bug #547941)
1086 - enigma 0.92.3-3 (embed)
1087 NOTE: likely fixed earlier, marking etch's version as fixed
1088
1089 linux-2.6
1090 - kvm <removed> (embed; bug #549973) [./kernel/*]
1091 - linux-kbuild-2.6 <unfixed> (embed; bug #550379) [./kbuild/*]
1092 - kernel-source-2.6.8 <removed> (old-version)
1093 - kernel-source-2.4.27 <removed> (old-version)
1094 - kernel-source-2.4.24 <removed> (old-version)
1095 - kernel-source-2.2.25 <removed> (old-version)
1096 - kernel-source-2.2.20 <removed> (old-version)
1097
1098 libfdt (not yet packaged separately for debian; http://www.jdl.com/software/)
1099 - kvm <removed> (embed) [./libfdt/*]
1100 - qemu-kvm <unfixed> (embed) [./libfdt/*]
1101
1102 qweb (not packaged)
1103 - ajaxterm <unfixed>
1104
1105 opensaml2
1106 - opensaml <removed> (old-version)
1107
1108 shibboleth-sp2
1109 - shibboleth-sp <removed> (old-version)
1110
1111 tuxonice-userui
1112 - suspend2-userui <removed> (old-version)
1113
1114 expat
1115 - w3c-libwww <removed> (embed; bug #551941)
1116 [etch] - w3c-libwww <unfixed> (embed; bug #551941) [./modules/expat/*]
1117 - python-xml <unfixed> (embed; bug #551940) [./extensions/expat/*]
1118 - python2.5 <unfixable> (embed; bug #553403) [./Modules/expat/*]
1119 - python2.4 <unfixable> (embed; bug #553403)
1120 - python-4suite <unfixed> (embed; bug #516935)
1121 - wxwindows2.4 <removed> (embed)
1122 - wxwidgets2.6 2.6.3.2.2-4 (embed)
1123 - wxwidgets2.8 2.8.10.1-2 (embed)
1124 - celementtree 1.0.5-8 (embed)
1125 NOTE: Maybe that was fixed even earlier
1126 - audacity 1.3.2-1 (embed)
1127 - matanza <unfixed> (embed)
1128 - tdom 0.8.3~20080525-1 (embed)
1129 - udunits 2.1.8-4 (embed)
1130 - apr-util 1.2 (embed)
1131 - ayttm <unfxed> (embed; bug #561006)
1132 - cableswig <unfixed> (embed)
1133 - cadaver <unfixed> (embed)
1134 - cmake 2.6.0-6 (embed)
1135 - coin3 <unfixed> (embed)
1136 - gdcm 2.0.14-2 (embed)
1137 - ghostscript <unfixed> (embed)
1138 - grmonitor <removed> (embed)
1139 - iceape <unfixed> (embed)
1140 - insighttoolkit 3.16.0-1 (embed)
1141 NOTE: insighttoolkit might've been fixed earlier
1142 - libparagui1.1 1.0.2-1 (embed)
1143 - paraview 3.6.2-1 (embed)
1144 - poco 1.3.6p1-1 (embed)
1145 - simgear <unfixed> (embed)
1146 - sitecopy 1:0.16.0-1
1147 - smart 1.0-1 (embed)
1148 - swish-e <not-affected> (Linked against libxml, which is used instead)
1149 - tla 1.3.5+dfsg-15 (embed)
1150 - vtk 4.1.20030227-1 (embed)
1151 - wbxml2 <not-affected> (expat code is only used on Mac OS X, see #560941)
1152 - xmlrpc-c <unfixed> (embed)
1153 - iceweasel <unfixed> (embed)
1154 - kompozer <unfixed> (embed)
1155 - vxl 1.13.0-2 (embed)
1156 - xulrunner <unfixed> (embed)
1157 - apache2 2.2 (embed)
1158 - texlive-bin <not-affected> (Embedded code not compiled in)
1159 - vnc4 <unfixed> (embed)
1160 - xotcl <unfixed> (embed)
1161
1162 xerces-c
1163 - xerces-c2 <unfixed> (old-version)
1164 - xerces27 <removed> (old-version)
1165
1166 md5 (RSA's version; not the gnu version provided by coreutils)
1167 - w3c-libwww <removed> (embed; bug #551942)
1168 [etch] - w3c-libwww <unfixed> (embed; bug #551942) [./modules/md5/*]
1169
1170 libparagui1.1
1171 - asc <unfixable> (fork)
1172
1173 enet
1174 - sauerbraten <unfixed> (embed; #497194)
1175
1176 eglibc
1177 - glibc <removed> (old-version)
1178
1179 galib
1180 - gamera 3.2.3-1 (embed)
1181
1182 configobj
1183 - bzr <unfixed> (embed; bug #555336)
1184 - elisa <unfixed> (embed; bug #555337)
1185 - gaupol <unfixed> (embed; bug #555338)
1186 - ipython <unfixed> (embed; bug #555339)
1187 - pida <unfixed> (embed; bug #555340)
1188 - psychopy <unfixed> (embed; bug #555341)
1189 - rest2web <unfixed> (embed; bug #555342)
1190 - auth2db <unknown> (embed)
1191 - dynagen <unknown> (embed)
1192 - iceweasel <unknown> (embed)
1193 - sabnzbdplus <unknown> (embed)
1194 - xulrunner <unknown> (embed)
1195 - nipy <not-affected> (part of an example [/examples/neurospin/neurospy/configobj.py], which is not installed into binary packages)
1196
1197 python-clientform
1198 - bibus <unfixed> (embed; bug #555332)
1199 - zope2.10 <unfixed> (embed; bug #555333)
1200 - zope2.11 <removed> (embed; bug #555334)
1201 - python-mechanize <unknown> (embed)
1202 - twill <unknown> (embed)
1203
1204 python-mechanize
1205 - zope2.10 <unfixed> (embed; bug #555337)
1206 - zope2.11 <removed> (embed; bug #555338)
1207 - twill <unknown> (embed; bug #555339)
1208
1209 pexpect
1210 - duplicity 0.6.06-1 (embed; bug #555361)
1211 - hplip <unfixed> (embed; bug #555362)
1212 - smart <unfixed> (embed; bug #555363)
1213
1214 pyparsing
1215 - bauble <unfixed> (embed; bug #555366)
1216 - boa-constructor 0.6.1-8 (embed; bug #555367)
1217 - calibre <unfixed> (embed; bug #555368)
1218 - matplotlib <unfixed> (embed; bug #531024)
1219 - zhpy 1.7.3.1-1 (embed; bug #555370)
1220 - polybori <unknown> (embed)
1221 - python-whoosh <unknown> (embed)
1222 - twill <unknown> (embed)
1223 - zope-textindexng3 <unknown> (embed)
1224
1225 python-pysqlite2
1226 - python2.4 <unfixed> (embed; bug #553403)
1227 - python2.5 <unfixed> (embed; bug #553403)
1228
1229 celementtree
1230 - python2.5 <unfixed> (embed)
1231 - smart 1.0-1 (embed)
1232 [etch] - smart <unfixed> (embed)
1233
1234 elementtree
1235 - python2.5 <unfixed> (embed)
1236 - bzr <unfixed> (embed; bug #555343)
1237 - gedit 2.28.2-1 (embed; bug #555344)
1238 - smart 1.0-1 (embed)
1239 [etch] - smart <unfixed> (embed)
1240 - solfege <unfixed> (embed; bug #555345)
1241 - w3af <unfixed> (embed; bug #555346)
1242 - python-qt4 <unknown> (embed)
1243 - sphinx <unknown> (embed)
1244 - python-nltk <itp> (embed)
1245
1246 python2.5
1247 - python2.4 <unfixed> (old-version)
1248 - jython <unfixed> (embed)
1249 NOTE: embeds many stdlib modules
1250 - python-django <unfixed> (embed; bug #555419)
1251 NOTE: embeds stdlib modules: doctest, decimal
1252 - gamera 3.2.3-1 (embed)
1253 NOTE: embeds stdlib modules: ConfigParser, optparse, sets, textwrap
1254 - boa-constructor <unfixed> (embed; bug #555426)
1255 NOTE: embeds stdlib modules: ConfigParser, tarfile, zipfile, xmlrpclib
1256 - nicotine <unfixed> (embed; bug #555427)
1257 NOTE: embeds stdlib modules: ConfigParser
1258 - museek+ <unfixed> (embed; bug #555428)
1259 NOTE: embeds stdlib modules: ConfigParser
1260 - vegastrike-data <unfixed> (embed)
1261 NOTE: embeds many stdlib modules
1262 - codespeak-lib 1.1.1-1 (embed; bug #555420)
1263 NOTE: embeds stdlib modules: doctest, optparse, subprocess, textwrap
1264 - config-manager <unfixed> (embed; bug #555423)
1265 NOTE: embeds stdlib modules: optparse
1266 - jhbuild 2.28.0-1 (embed; bug #555421)
1267 NOTE: embeds stdlib modules: optparse, subprocess
1268 - smart <unfixed> (embed; bug #555432)
1269 NOTE: embeds stdlib modules: optparse
1270 - pyprotocols 1.0a.svn20070625-5 (embed; bug #555433)
1271 NOTE: embeds stdlib modules: doctest
1272 - ruledispatch 0.5a.svn20080510-4 (embed; bug #555434)
1273 NOTE: embeds stdlib modules: doctest
1274 - distribute <unfixed> (embed)
1275 NOTE: embeds stdlib modules: doctest
1276 - python-setuptools <unfixed> (embed; bug #555435)
1277 NOTE: embeds stdlib modules: doctest
1278 - zope.testing <unfixed> (embed; bug #555436)
1279 NOTE: embeds stdlib modules: doctest
1280 - translate-toolkit <unfixed> (embed; bug #555422)
1281 NOTE: embeds stdlib modules: textwrap, contextlib
1282 - libtpclient-py <unfixed> (embed; bug #555424)
1283 NOTE: embeds stdlib modules: subprocess
1284 - grass <unfixed> (embed; bug #555425)
1285 NOTE: embeds stdlib modules: subprocess
1286 - coherence <unfixed> (embed; bug #555429)
1287 NOTE: embeds stdlib modules: uuid
1288 - python-django-extensions 0.4.2pre+git200911182050-1 (embed; bug #555430)
1289 NOTE: embeds stdlib modules: uuid
1290 - setroubleshoot <unfixed> (embed; bug #555431)
1291 NOTE: embeds stdlib modules: uuid
1292 - linkchecker <unfixed> (embed; bug #555414)
1293 NOTE: embeds msgfmt.py script
1294 - imdbpy <unfixed> (embed)
1295 NOTE: embeds msgfmt.py script
1296 - kiwi <unfixed> (embed)
1297 NOTE: embeds msgfmt.py script
1298 - moin <unfixed> (embed)
1299 NOTE: embeds msgfmt.py script, stdlib modules: cgitb, difflib, tarfile
1300 - plone3 <removed> (embed)
1301 NOTE: embeds msgfmt.py script
1302 - roundup <unfixed> (embed)
1303 NOTE: embeds msgfmt.py script, stdlib modules: cgitb
1304 - rednotebook <unfixed> (embed; bug #555415)
1305 NOTE: embeds msgfmt.py script
1306 - turbogears <unfixed> (embed)
1307 NOTE: embeds msgfmt.py script
1308 - elisa <unfixed> (embed)
1309 NOTE: embeds msgfmt.py script, stdlib modules: uuid
1310 - calibre <unfixed> (embed)
1311 NOTE: embeds msgfmt.py script, stdlib modules: zipfile
1312 - mailman 1:2.1.13-1 (embed; #555416)
1313 NOTE: embeds msgfmt.py script
1314 - python-docutils <unknown> (embed)
1315 NOTE: embeds stdlib modules: optparse, textwrap
1316 - python-imaging <unknown> (embed)
1317 NOTE: embeds stdlib modules: doctest
1318 - python-mechanize <unknown> (embed)
1319 NOTE: embeds stdlib modules: doctest
1320 - twill <unknown> (embed)
1321 NOTE: embeds stdlib modules: subprocess
1322 - zeroc-ice <unknown> (embed)
1323 NOTE: embeds stdlib modules: subprocess
1324 - wxwidgets2.8 <unknown> (embed)
1325 NOTE: embeds stdlib modules: subprocess
1326 - cycle <unknown> (embed)
1327 NOTE: embeds msgfmt.py script
1328 - deluge <unknown> (embed)
1329 NOTE: embeds msgfmt.py script
1330 - opendict <unknown> (embed)
1331 NOTE: embeds msgfmt.py script
1332 - openerp-client <unknown> (embed)
1333 NOTE: embeds msgfmt.py script
1334 - rapidsvn <unknown> (embed)
1335 NOTE: embeds msgfmt.py script
1336 - wammu <unknown> (embed)
1337 NOTE: embeds msgfmt.py script
1338 - gaphor <unknown> (embed)
1339 NOTE: embeds msgfmt.py script
1340 - pida <unknown> (embed)
1341 NOTE: embeds msgfmt.py script
1342 - python-formencode <unknown> (embed)
1343 NOTE: embeds msgfmt.py script
1344 - duplicity <unfixed> (embed)
1345 NOTE: embeds stdlib module: urlparse, tarfile
1346 - pygopherd <unfixed> (embed)
1347 NOTE: embeds stdlib module: zipfile
1348
1349 argparse
1350 - twill <unfixed> (embed; bug #555347)
1351 - ipython <unfixed> (embed; bug #555348)
1352
1353 coherence
1354 - elisa <unfixed> (embed; bug #555335)
1355
1356 simpletal
1357 - plastex <unfixed> (embed; bug #555371)
1358
1359 flickrpc (not packaged in Debian, http://burtonini.com/bzr/flickrpc/)
1360 - postr <unfixed> (embed)
1361 - elisa <unfixed> (embed)
1362
1363 simplegeneric (not packaged in Debian, http://pypi.python.org/pypi/simplegeneric)
1364 - apertium-tolk <unfixed> (embed)
1365 - ipython <unfixed> (embed)
1366 - virtaal <unfixed> (embed)
1367
1368 distribute
1369 - setuptools <removed> (old-version)
1370
1371 rails
1372 - jruby1.2 <unfixed> (embed) [./bench/rails/*]
1373 - libgettext-ruby <unfixed> (embed) [./samples/rails/*]
1374 - libopenid-ruby <unfixed> (embed) [./examples/rails_openid/*]
1375 - thin <unfixed> (embed) [./spec/rails_app/*]
1376 NOTE: this is a subdirectory of examples, which in general is a non-issue, but may
1377 NOTE: be dangerous if developers are naively basing their code off of the examples
1378 NOTE: prototype.js is among the example files
1379
1380 lucene2 (prototype.js is among the embeds in the following)
1381 - lucene <unfixed> (old-version)
1382 - pylucene <unfixed> (embed)
1383 - libpdfbox-java <unfixed> (embed)
1384 - libfontbox-java <unfixed> (embed)
1385 - libjempbox-java <unfixed> (embed)
1386 - solr <unfixed> (embed)
1387
1388 unicode-data
1389 - syslinux <unfixed> (embed)
1390 - camomile <unfixed> (embed)
1391 - fribidi <unfixed> (embed)
1392 - m17n-db <unfixed> (embed)
1393 - sbcl <unfixed> (embed)
1394 - heimdal <unfixed> (embed)
1395 - icu <unfixed> (embed)
1396 - icu4j <unfixed> (embed)
1397 - krb5 <unfixed> (embed)
1398 - moodle <unfixed> (embed)
1399 - openldap <unfixed> (embed)
1400 - pike7.6 <unfixed> (embed)
1401 - samba <unfixed> (embed)
1402 - samba4 <unfixed> (embed)
1403 - cmucl <unfixed> (embed)
1404 - typo3-src <unfixed> (embed)
1405 - mauve <unfixed> (embed)
1406 - texlive-bin <unfixed> (embed)
1407 - ypsilon <unfixed> (embed)
1408 - jeuclid <unfixed> (embed)
1409 - charmap.app <unfixed> (embed)
1410 - clisp <unfixed> (embed)
1411 - gnulib <unfixed> (embed)
1412 - opensrs-client <unfixed> (embed)
1413 - saxonb <unfixed> (embed)
1414 - rails <unfixed> (embed)
1415
1416 feedparser
1417 - rawdog <unfixed> (embed; bug #383422)
1418 - miro <unfixed> (embed; bug #555351)
1419 - calibre <unfixed> (embed; bug #555352)
1420 - freevo <unfixed> (embed; bug #555353)
1421 - pida <unfixed> (embed; bug #555354)
1422 - planet-venus <unfixed> (embed; bug #555355)
1423 - plone3 <removed> (embed; bug #555356)
1424 - exaile 0.2.14+debian-1 (embed)
1425 - screenlets 0.1.2-3 (embed)
1426 NOTE: included twice
1427
1428 agg:
1429 - matplotlib <unfixed> (embed: bug #377271)
1430 - contextfree <unfixed> (embed)
1431 NOTE: since 2.2-1 it links statically to system libagg, but still uses the embedded copy
1432 - exactimage <unfixed> (embed)
1433 - python-enable <unfixed> (embed)
1434 - mapnik 0.5.1-3 (embed)
1435 NOTE: links statically to agg, but shared library is not available (bug #377271)
1436
1437 vtk
1438 - paraview <unfixable> (embed; bug #495426)
1439
1440 txt2tags
1441 - rednotebook <unfixed> (embed)
1442
1443 htmltextview (not packaged in Debian, http://www.gnome.org/~gjc/htmltextview.py)
1444 - gajim <unfixed> (embed)
1445 - emesene <unfixed> (embed)
1446 - convirt <unfixed> (embed)
1447 - pida <unfixed> (embed)
1448 - rednotebook <unfixed> (embed)
1449
1450 horde3 (prototype.js is among the embeds in the following)
1451 - mnemo2 <unfixed> (embed)
1452 - nag2 <unfixed> (embed)
1453 - wordpress <unfixed> (embed)
1454 NOTE: Text_Diff (wp-includes/Text/Diff*)
1455
1456 cimg
1457 - gmic <itp> (embed)
1458
1459 mootools
1460 - gmic <itp> (embed)
1461
1462 openldap
1463 - openldap2.3 <removed> (old-version)
1464
1465 grub2
1466 - grub <unfixed> (old-version)
1467
1468 gnupginterface
1469 - duplicity <unfixed> (embed)
1470
1471 python-dateutil
1472 - awn-extras-applets <unfixed> (embed)
1473 - matplotlib <unknown> (embed)
1474
1475 cups
1476 - cupsys <removed> (old-version)
1477
1478 yui
1479 - bcfg2 <not-affected> (present in source but not included in any binary files)
1480 - serendipity <unfixed> (embed; bug #557746)
1481 - moodle 1.8.2.dfsg-5 (embed)
1482 - jifty 0.91117-1 (embed; bug #557748)
1483 - webgui 7.7.26-1 (embed)
1484 - loggerhead 1.17-1 (embed)
1485
1486 quake3 (vanilla source not packaged in debian)
1487 - openarena <unfixable> (fork)
1488
1489 quake2 (vanilla source not packaged in debian)
1490 - alien-arena <unfixable> (fork)
1491 - warsow <unfixable> (fork)
1492
1493 libtheora
1494 - iceweasel <not-affected> (uses xulrunner)
1495 - xulrunner <unfixed> (embed; bug #540959)
1496 [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1497 [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1498 - iceape <unfixed> (embed; bug #559276)
1499 [etch] - iceape <not-affected> (introduced in iceape 2.0)
1500 [lenny] - iceape <not-affected> (introduced in iceape 2.0)
1501
1502 dtoa
1503 - bfilter <unfixed> (embed)
1504 - cacao <unfixed> (embed)
1505 - cdrdao <unfixed> (embed)
1506 - classpath <unfixed> (embed)
1507 - freej <unfixed> (embed)
1508 - iceape <unfixed> (embed)
1509 - iceweasel <unfixed> (embed)
1510 - jscoverage <unfixed> (embed)
1511 - kde4libs <unfixed> (embed)
1512 - kdelibs <unfixed> (embed)
1513 - kompozer <unfixed> (embed)
1514 - libv8 <unfixed> (embed)
1515 - mono <unfixed> (embed)
1516 - newlib <unfixed> (embed)
1517 - nspr <unfixed> (embed)
1518 - php5 <unfixed> (embed)
1519 - polyml <unfixed> (embed)
1520 - qt4-x11 <unfixed> (embed)
1521 - rhino <unfixed> (embed)
1522 NOTE: code translated to Java
1523 - ruby1.8 <unfixed> (embed)
1524 - ruby1.9 <unfixed> (embed)
1525 - ruby1.9.1 <unfixed> (embed)
1526 - sdd <unfixed> (embed)
1527 - sfind <unfixed> (embed)
1528 - star <unfixed> (embed)
1529 - tinymux <unfixed> (embed)
1530 - virtualbox-ose <unfixed> (embed)
1531 - webkit <unfixed> (embed)
1532 - xulrunner <unfixed> (embed)
1533
1534 ipc (not packaged in Debian; see http://mozdev.org/pipermail/enigmail/2009-November/011678.html)
1535 - firegpg <unfixed> (embed)
1536 - enigmail <unfixed> (embed)
1537
1538 ptmalloc (not packaged in Debian)
1539 - crystalspace <unfixed> (embed)
1540 - qt4-x11 <unfixed> (embed)
1541
1542 svgalib
1543 - usplash <unfixed> (embed)
1544
1545 bogl
1546 - usplash <unfixed> (embed)
1547
1548 taglist
1549 - usplash <unfixed> (embed)
1550
1551 portaudio
1552 - audacity <unfixed> (embed; bug #323711)
1553
1554 nyquist
1555 - audacity <unfixed> (embed)
1556 NOTE: embeds a forked nyquist with support for a shared library
1557
1558 vamp-plugin-sdk
1559 - audacity <unfixed> (embed)
1560
1561 wordpress
1562 - libwordpress-xmlrpc-perl <removed> (embed) [./xmlrpc.php]
1563 - wordpress-mu <unfixed> (fork)
1564
1565 php5
1566 - php4 <removed> (old-version)
1567
1568 classpath
1569 - libgnucrypto-java <removed> (embed; bug #559788)
1570
1571 libtool
1572 - apr <unfixed> (static; bug #489625)
1573 NOTE: ships copy of libtool in libapr1-dev; was 'embed' before 1.3.2-3
1574 - arts <unfixed> (embed)
1575 - bochs 2.4.2-1 (embed; bug #560884)
1576 - camserv <unfixed> (embed)
1577 - collectd 4.8.2-1 (embed)
1578 - courier-authlib 0.58-4 (embed)
1579 NOTE: The etch version of courier-authlib was the earliest version checked, might be fixed earlier
1580 - cvsnt <unfixed> (embed)
1581 - dico <not-affected> (Uses the system copy of ltdl)
1582 - freeradius 0.1+20010527-1 (embed)
1583 NOTE: Earliest reference I could find from the changelog is from 27 May 2001
1584 - ggobi 2.1.9~20091212-1 (embed)
1585 - glame 2.0.1-4 (embed)
1586 NOTE: The etch version of glame was the earliest version checked, might be fixed earlier
1587 - gnash <unfixed> (embed)
1588 - gnu-smalltalk <unfixed> (embed; bug #566777)
1589 - google-gadgets 0.10.5-0.3 (embed)
1590 NOTE: 0.10.5-0.3 was the earliest version checked, was fixed earlier
1591 - graphicsmagick 1.3.5-6 (embed)
1592 - graphviz 2.8-3 (embed)
1593 NOTE: The etch version of graphviz was the earliest version checked, might be fixed earlier
1594 - guile-1.6 1.6.8-7 (embed)
1595 - hamlib <unfixed> (embed)
1596 - hercules 3.06-1.2 (embed)
1597 - jags 1.0.4-3 (embed; bug #560864)
1598 - kdelibs <unfixed> (embed)
1599 - libannodex <removed> (embed)
1600 - libextractor 0.5.23+dfsg-4 (embed)
1601 - libmcrypt <not-affected> (libtool source present but not included in any of the binary packages)
1602 - libtunepimp <unfixed> (embed)
1603 - mp4h <unfixed> (embed)
1604 - naim <removed> (embed)
1605 - parser-mysql <unfixed> (embed)
1606 - pinball 0.3.1-11 (embed)
1607 - redland <unfixed> (embed)
1608 - siproxd <unfixed> (embed)
1609 - ski <unfixed> (embed)
1610 - synfig 0.62.00-1 (embed)
1611 - unixodbc 2.2.4-5 (embed)
1612 - xmlsec1 <not-affected> (Doesn't enable dynamic loading of crypto modules)
1613 - clamav 0.95+dfsg-1 (embed)
1614 - imagemagick 6:6.2.3.1-1 (embed)
1615 - hypre 2.4.0b-5 (embed)
1616 - lam <unfixed> (embed)
1617 - openmpi <unfixable> (embed; bug #559386)
1618 - parser <unfixed> (embed)
1619 - pdsh 2.18-5 (embed; bug #560892)
1620 - sbnc 1.2-8 (embed)
1621 - sdcc <unfixed> (embed)
1622 - wml <unfixed> (embed)
1623 - proftpd-dfsg <unfixed> (embed; bug #561748)
1624 - babel 1.4.0.dfsg-5 (embed)
1625 - libprelude 0.9.14-2 (embed)
1626 - heartbeat 2.1.4-7 (embed)
1627 NOTE: From Squeeze onwards the system copy of ltdl is used, use the current version from Squeeze,
1628 NOTE: might've been fixed earlier
1629 - gcc-* <unknown> (embed)
1630
1631 ocamlgsl
1632 - orpie 1.5.1-7.1 (embed; bug #550058)
1633
1634 xdotool
1635 - keynav <unfixed> (embed; bug #560103)
1636
1637 bulletphysics (not packaged; http://www.bulletphysics.org/)
1638 - supertuxkart <unfixed> (embed)
1639 - blender <unfixed> (embed)
1640
1641 ghostscript
1642 - gs-gpl <removed> (old-version)
1643
1644 icedove
1645 - thunderbird <removed> (old-version)
1646
1647 sizzlejs (not packaged in Debian, http://sizzlejs.com/)
1648 - jquery <unfixed> (embed)
1649
1650 sed
1651 - ssed <unfixed> (fork)
1652
1653 phpatomlib (http://code.google.com/p/phpatomlib)
1654 - wordpress <unfixed> (embed)
1655
1656 Services_JSON (http://pear.php.net/package/Services_JSON)
1657 - wordpress <unfixed> (embed)
1658
1659 phpass (http://www.openwall.com/phpass/)
1660 - gallery2 <unfixed> (embed)
1661 - wordpress <unfixed> (embed)
1662 - typo3-src <unfixed> (fork)
1663 NOTE: file refers to drupal, maybe there's a copy somewhere there
1664 NOTE: a copyright owner search didn't match anything
1665 - libauthen-passphrase-perl <unfixable> (fork)
1666 NOTE: perl implementation of phpass
1667
1668 squirrelmail
1669 - wordpress <unfixed> (embed)
1670 NOTE: class-pop3.php
1671
1672 ezSQL (http://www.woyano.com/jv/ezsql)
1673 - wordpress <unfixable> (fork)
1674 NOTE: wp-db.php
1675
1676 Diff.php (Clay Loveless' version/killersoft.com)
1677 - php-versioncontrol-svn <unfixed>
1678
1679 libm
1680 - spring <unfixed> (embed)
1681 NOTE: embedded by embedded copy of streflop
1682
1683 streflop
1684 - spring <unfixed> (embed)
1685
1686 minizip
1687 - spring <unfixed> (embed)
1688
1689 oscpack
1690 - spring <unfixed> (embed)
1691
1692 hpiutil2
1693 - spring <unfixed> (embed)
1694
1695 p7zip
1696 - spring <unfixed> (embed)
1697
1698 pythonqt (doesn't seem to be python-qtN, unknown source)
1699 - fontmatrix <unfixed> (embed)
1700 - elmerfem <unfixed> (embed)
1701
1702 iepngfix (not packaged in Debian; http://www.twinhelix.com/css/iepngfix/)
1703 - docvert <unfixed> (embed)
1704 - jifty <unfixed> (embed)
1705 - kdenetwork <unfixed> (embed)
1706 - mediatomb <unfixed> (embed)
1707 - plastex <unfixed> (embed)
1708 - plone3 <removed> (embed)
1709 - python-chaco <unfixed> (embed)
1710 - python-docutils <unfixed> (embed)
1711 - s5 <unfixed> (embed)
1712 - zope2.10 <unfixed> (embed)
1713 - zope2.11 <removed> (embed)
1714 - cython <not-affcted> (embed)
1715 NOTE: part of documentation, which is not installed into the binary package
1716
1717 python-docutils
1718 - zope2.10 <unfixed> (embed)
1719 - zope2.11 <removed> (embed)
1720
1721 tesseract
1722 - ocropus <unfixed> (static)
1723
1724 antlr
1725 - kdevelop <unfixed> (embed)
1726
1727 libxerces2
1728 - openjdk-6 <unfixed> (embed)
1729
1730 kfreebsd-8
1731 - kfreebsd-7 <unfixed> (old-version)
1732 - kfreebsd-6 <removed> (old-version)
1733
1734 ruby1.9.1
1735 - ruby1.9 <unfixed> (old-version)
1736 - ruby1.8 <unfixed> (old-version)
1737
1738 maildrop
1739 - courier <unfixed> (embed) [./maildrop]

  ViewVC Help
Powered by ViewVC 1.1.5