/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 2037 by jmm-guest, Sun Sep 18 10:11:02 2005 UTC revision 13116 by gilbert-guest, Wed Oct 28 15:08:26 2009 UTC
# Line 1  Line 1 
1  This file collects cases, where a source package embeds code from  Embedded code copies
2  other projects, without linking dynamically:  ====================
3    
4  xpdf code: (some use xpdf 2, some xpdf 3)  This file collects source packages that embed code from other projects.
5  gpdf  This is considered bad for fixing security flaws because the fix needs
6  pdftohtml  to be applied in multiple source packages.
7  kdegraphics/kpdf  
8  tetex-bin  Format:
9  cupsys (only older releases, recent ones use xpdf-utils, it's still present in the src, though)  <srcpkg> (<optional comment about srcpkg>)
10  poppler          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11            NOTE: optional comments about the linkage of the embedding srcpkg
12    
13    status: version number fixing the embedded copy, <unfixed>, <removed>,
14            <itp>, <not-affected>, <unknown> if the version number can not
15            be determined, or <unfixable> for unavoidable cases (e.g., forks
16            that add real value)
17    sort: static (linking statically against a lib)
18          embed (embedding a copy of the library into another source package)
19          fork (the package is not just embedding code but it is a fork and
20                thus might share parts of the source code)
21          old-version (the package is an older version of essentially
22                       the same code)
23    
24    The srcpkg might be some string to identify the code if there is no
25    specific source package.
26    
27    Everything up to the next line is ignored.
28    ---BEGIN
29    xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
30            NOTE: Fixed packages link to poppler library unless otherwise noted
31            - pdftohtml <unknown>
32            [sarge] - pdftohtml <unfixed>
33            [etch] - pdftohtml <unfixed>
34            NOTE: has been replaced by poppler-utils
35            - kdegraphics 4:4.2.2-1 (embed; bug #436164)
36            - texlive-base 3.0-12 (embed)
37            - texlive-bin 2007-1 (embed)
38            NOTE: links to poppler
39            - koffice <unfixed> (embed; bug #436163)
40            - libextractor 0.5.12-1 (embed)
41            NOTE: libextractor is using its own pdf decoder now
42            - ipe <unfixed> (embed)
43            NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
44            - ruby-gnome2 <unknown> (embed)
45            NOTE: copy only present in source but links to poppler
46            - pdfedit <unfixed> (embed; bug #510794)
47            - swftools <unfixed> (embed; bug #551293)
48            - poppler <unfixable> (fork)
49    
50    ppmd
51            - libcomplearn-mod-ppmd <unfixed> (fork)
52            NOTE: discussion in #458152
53    
54    libevent
55            - transmission 1.71-1 (embed; bug #529372)
56    
57    lrmi
58            - read-edid 2.0.0-1 (embed; bug #495131)
59    
60    peercast
61            - gnome-peercast <unfixed> (embed)
62            NOTE: gnome-peercast may better be removed, see #466539
63    
64    silc-toolkit
65            - silc-client 1.1~beta6-1 (embed)
66    
67    icclib
68            - ghostscript <unfixed> (embed)
69            - argyll <unfixed> (embed)
70    
71    dietlibc
72            - ccontrol 0.9.1+20071204-1 (static)
73    
74    libmikmod
75            - sdl-mixer1.2 <unfixed> (embed)
76            TODO: report bug
77    
78    libiax
79            - iaxmodem <unfixable> (embed; bug #548885)
80    
81    spandsp
82            - iaxmodem <unfixable> (embed; bug #548885)
83    
84    zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
85            - dpkg <unfixed> (embed)
86            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
87            - rsync <unfixed> (embed)
88            NOTE: somehow derived code base
89            - mono <unfixed> (embed)
90            TODO: check mozilla
91            - Linux kernels <unfixed> (embed)
92            - pvpgn 1.7.8-2 (embed)
93            - mrtg 2.12.2-1 (embed)
94            - rpm <unknown> (embed)
95            NOTE: pinged anibal since when rpm was fixed
96            - tuxcmd-modules <unfixed> (embed)
97            - zsync <unfixed>
98            - tra <unfixed>
99            - sash <unfixed>
100            - nsis <unfixed>
101            - mseide-msegui <unfixed>
102            NOTE: mseide
103            - mirrordir <unfixed>
104            - poco <unfixed>
105            - klibc <unfixed>
106            - ghostscript <unfixed>
107            - freeimage <unfixed>
108            - clamav <unfixed> (fork)
109            NOTE: from the changelog: "libclamav6 does indeed duplicate parts of the zlib code, but there is not way around that"
110            - tuxonice-userui <unfixed>
111            - plt-scheme <unfixed>
112            - perl <unfixed>
113            - paraview <unfixed>
114            - gcvs <unfixed>
115            - erlang <unfixed>
116            - dump <unfixed>
117            - aide <unfixed> (static)
118            - dar <unfixed> (static)
119            - avfs <unfixed>
120            - fpc <unfixed>
121            - winff <unfixed>
122            NOTE: inherited from fpc, see #472304
123            - lazarus <unfixed>
124            NOTE: inherited from fpc, see #472304
125            - erlang <unfixed> (embed)
126    
127    dulwich
128            - hg-git <unfixed> (embed; bug #541996)
129    
130    libvigraimpex
131            - hugin <unfixed> (embed; bug #542259)
132            - enblend-enfuse <unfixed> (embed; bug #542258)
133    
134    libbz2
135            - dpkg <unfixed> (static)
136    
137    libgadu
138            - centericq <unfixed> (embed)
139            - pidgin <unfixed> (embed)
140            NOTE: pidgin links dynamically against libgadu; that should be fixed, then???
141            - kdenetwork 4:3.3.2-5 (embed)
142            NOTE: from kdenetwork: kopete
143            - ekg 1:1.8~rc0-1 (embed)
144            - kadu 0.6.0.2-3 (embed; bug #504430)
145            - gadu <itp> (embed)
146    
147    xmlrpc (which package is the "origin" of this code?)
148            - drupal <unfixed> (embed)
149            - phpgroupware <unfixed> (embed)
150            - egroupware <unfixed> (embed)
151            - phpwiki <unfixed> (embed)
152            - php4 <unfixed> (embed)
153            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
154    
155    shtool (affects build-time only)
156            - mysql-ocaml <unfixed> (embed)
157            - php4 <unfixed> (embed)
158    
159    iceape
160            - iceweasel <unfixed> (fork)
161            - icedove <unfixed> (fork)
162            - xulrunner <unfixed> (fork)
163            - kompozer <unfixed> (embed; bug #532168)
164    
165    xli
166            - xloadimage <unfixed> (embed)
167    
168    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
169            - openmotif <unfixed> (embed)
170            - libxpm <unfixed> (embed)
171    
172    kerberized apps with BSD origin
173            - krb4 <removed> (embed)
174            - krb5 <unfixed> (embed)
175            - heimdal <unfixed> (embed)
176    
177    grip (which pkg is the origin?)
178            - libcdaudio <unfixed>
179            - grip <unfixed>
180            - gnome-vfs <unfixed>
181            TODO: check vfs2 as well
182    
183    fudforum
184            [etch] - phpgroupware <unfixed> (embed)
185            NOTE: phpgroupware-fudforum
186            [sarge] - egroupware-fudforum <removed> (embed)
187    
188    libbsd
189            - rdate 1:1.2-3 (embed)
190            - atheme-services <unfixed>
191            - libbsd-arc4random-perl <unfixed>
192            - isakmpd <unfixed>
193    
194    cvs
195            - gcvs <unfixed> (embed)
196            NOTE: see cvsunix/src in tarball
197    
198    pcre
199            - python* <unfixed> (embed)
200            - php4 <unknown> (embed)
201            - analog 2:5.23-0woody1 (embed)
202            - goffice <unfixed> (embed)
203            NOTE: libgoffice-*
204            - vfu 4.06-4.1 (embed; bug #450754)
205            - tf5 5.0beta7-1 (embed)
206            - monotone 0.43-1 (embed)
207            NOTE: this only affects versions >= 0.37
208            - glib2.0 2.15.2-1 (embed)
209            - apache2 2.0.53-4 (embed)
210            - exim4 4.10-0.srh20.12 (embed)
211            - yacas <unfixed> (embed)
212            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
213            - gtamsanalyzer.app 0.42-5 (embed)
214            - tin <unknown> (embed)
215            - kazehakase 0.5.2-1
216            - webkit 1.0.1-1 (embed)
217            - qt4-x11 <unfixed> (embed)
218            NOTE: embedded via webkit copy
219            - erlang <unfixed> (embed)
220    
221    tiff
222            - wxwindows2.4 2.2.1 (embed)
223    
224    uudeview
225            - libconvert-uulib-perl <unfixed> (embed)
226            - pan <unfixed> (embed)
227    
228    sqlite (not affected by security vulnerabilities so far)
229            - amarok <unfixed> (embed)
230            - monotone 0.43-1 (embed)
231            - iceweasel <unfixed> (embed)
232    
233    util-linux/mount
234            - loop-aes-utils <unfixed> (embed)
235            NOTE: contains code from util-linux' mount in the mount-aes-udeb
236    
237    sylpheed
238            - sylpheed-claws <unfixed> (fork)
239    
240    phpsysinfo
241            - egroupware <unfixed> (embed)
242            - phpgroupware <unfixed> (embed)
243    
244    phpldapadmin
245            [sarge] - egroupware <unfixed> (embed)
246            NOTE: removed from egroupware after sarge
247    
248    chmlib
249            - kchmviewer <unknown> (embed)
250    
251    ffmpeg (libavcodec/libavformat)
252            - mplayer 1.0~rc2-14 (embed; bug #395252)
253            - kino 1.0.0-1
254            - vlc <not-affected> (Links dynamically since initial release)
255            - smilutils 0.3.0-10
256            NOTE: smilutils likely fixed earlier, marking Etch's version as fixed
257            - motion 3.1.19-1
258            - gstreamer0.10-ffmpeg 0.10.3-2
259            - xmovie <removed> (static)
260            TODO: gimp-gap (potentially using ffmpeg code as well)
261            - avifile <unfixed> (embed; bug #538750)
262    
263    faad2
264            - mplayer 1.0~rc2-20 (embed)
265            - avifile <unfixed> (embed; bug #538750)
266    
267    libmad (MPEG decoding lib)
268            - xine-lib <unfixed> (embed)
269            - avifile <unfixed> (embed) [./plugins/libmad/*]
270            TODO: check ocaml-mad, madplay, pymad, xmms-mad, xmms2
271    
272    libdts
273            - xine-lib <unfixed> (embed)
274    
275    flac
276            - xine-lib <unfixed> (embed)
277    
278    liba52
279            - a52dec <unfixed> (embed)
280            - xine-lib <unfixed> (embed)
281    
282    libmpeg2
283            - mpeg2dec <unfixed> (embed)
284            - xine-lib <unfixed> (embed)
285    
286    libntlm
287            - wget <unfixed> (fork; bug #550436)
288            - curl <unfixed> (fork; bug #550437)
289            - cntlm <unfixed> (fork; bug #550438)
290    
291    uw-imap
292            - pine <unfixed> (embed)
293            - alpine <unfixed> (embed)
294    
295    imagemagick
296            - graphicsmagick <unfixed> (fork)
297    
298    python-urlgrabber
299            - mercurial <unfixed> (embed; bug #531062)
300    
301    python-mechanize
302            - beautifulsoup <unfixed> (embed)
303    
304    halibut
305            - nsis <unfixed> (fork)
306    
307    libghttp
308            - hotway <unfixed> (embed)
309    
310    libsndfile
311            - ardour 1:2.7.1-1 (embed)
312    
313    glibmm2.4
314            - ardour 1:2.7.1-1 (embed)
315    
316    libgnomecanvasmm2.6
317            - ardour 1:2.7.1-1 (embed)
318    
319    libsigc++-2.0
320            - ardour 1:2.7.1-1 (embed)
321    
322    soundtouch
323            - ardour 1:2.7.1-1 (embed)
324    
325    libmms
326            - xine-lib <unfixed> (embed)
327            - mimms <unfixed> (embed)
328    
329    fckeditor
330            - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
331            - moin 1.8.2-2 (embed; bug #452599)
332            - karrigell <removed> (embed; bug #452598)
333            - gforge 4.6.99+svn6225-1 (embed)
334            - request-tracker3.8 <unfixed> (embed)
335    
336    ipatlas (not packaged in Debian)
337            - moodle <unfixed> (embed; bug #507185)
338    
339    libphp-phpmailer
340            - moodle <unfixed> (embed; bug #507185)
341            - mahara <unfixed> (embed)
342            - symfony <unfixed> (embed)
343            [etch] - phpgroupware <unfixed> (embed)
344            NOTE: phpgroupware-felamimail is only in etch
345            - egroupware <unfixed> (embed; bug #504283)
346            - glpi <unfixed>
347    
348    htmlArea (not packaged in Debian)
349            - moodle <unfixed> (embed)
350    
351    giflib:
352            - wine <unfixed> (embed; bug #466181)
353    
354    bennu (not packaged in Debian, http://bennu.sourceforge.net)
355            - moodle <unfixed> (embed)
356    
357    smarty:
358            - moodle 1.8.2-2 (embed; bug #471158)
359            - gallery2 2.2.5-2 (embed; bug #471160)
360            - mahara 0.9.2-2 (embed; bug #471201)
361            - gosa 2.4beta1-1 (embed; bug #471200)
362    
363    TinyMCE
364            - wordpress 2.5.1-3 (embed; bug #478257)
365            - moodle <unfixed> (embed; bug #507185)
366            - knowledgeroot <unfixed> (embed)
367            - joomla <itp> (bug #326398)
368    
369    scintilla (upstream provides static lib, rejected shared lib http://sf.net/support/tracker.php?aid=2488121)
370            - scite <unfixed> (embed)
371            - qscintilla <unfixed> (embed)
372            - qscintilla2 <unfixed> (embed)
373            - geany <unfixed> (fork)
374            - anjuta <unfixed> (embed)
375    
376    libphp-adodb
377            - moodle <unfixed> (embed; bug #507185)
378            NOTE: also AdoDB-XML Schema
379            - gallery2 <unfixed> (embed)
380            - phppgadmin <unfixed> (embed)
381            - egroupware <unfixed> (embed)
382            - phpwiki <unfixed> (embed)
383            - torrentflux 2.0beta1-2 (embed)
384            - ipplan <unfixed> (embed)
385            - typo3-src <unfixed> (embed)
386            - cacti <unknown> (embed)
387            [sarge] - cacti <unfixed> (embed)
388            NOTE: dependency exists, but internal version is used
389            - gforge 4.7~rc2-6 (embed)
390            - mahara <unfixed> (embed)
391    
392    gzip
393            - linux-kernel <unfixed> (embed)
394            NOTE: lib/inflate.c
395            - klibc <unfixed> (embed)
396            NOTE: based on linux-kernel gzip code
397            - busybox <unfixed> (embed)
398    
399    neon
400            - cadaver 0.22.3+debian-1 (embed; bug #188381)
401            - gnome-vfs2 <unfixed> (embed; bug #395874)
402            [etch] - litmus <unfixed> (embed; #395875)
403            - litmus <removed> (embed; #395875)
404            [sarge] - screem <unfixed> (embed)
405            - sitecopy 1:0.16.3-5 (embed; bug #395876)
406            [etch] - tla <unfixed> (embed; bug #395877)
407            [sarge] - tla <unfixed> (embed; bug #395877)
408    
409    libmodplug
410            - gst-plugins-bad0.10 <unfixed> (embed)
411    
412    libvncserver
413            - vino <unfixed> (embed)
414    
415    putty
416            - filezilla <unfixed> (embed)
417    
418    tinyxml (not packaged in Debian)
419            - filezilla <unfixed>
420    
421    gv
422            - evince <unfixed> (embed)
423            NOTE: ps/ tree from gv 3.5.8
424            NOTE: evince-gtk is affected (a component of evince source package)
425    
426    libXbae
427            - paw <removed> (embed)
428            [etch] - paw <unfixed> (embed)
429    
430    libgtkhtml
431            - claws-mail-extra-plugins <unfixed> (fork)
432    
433    libXaw
434            - paw <removed> (embed)
435            [etch] - paw <unfixed> (embed)
436            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
437    
438    libgd2
439            - graphviz <unfixed> (embed)
440            NOTE: lib/gd seems to be 2.0.33
441            - wml <unfixed> (embed)
442            - libwmf <unfixed> (embed)
443            NOTE: derived from gd 1.6.3
444    
445    rar
446            - unrar-nonfree <unfixed> (embed)
447    
448    unrar-free (maybe this code is derived from the original rar, too?)
449            - clamav <unfixed> (embed)
450            NOTE: seems to be disabled in default config
451    
452    mplayer (DirectMedia Object loader)
453            - xine-lib <unfixed> (embed)
454            NOTE: src/libw32dll/
455            - vlc <unfixed> (embed)
456            NOTE: modules/codec/dmo/
457            - mplayer 1.0~rc2-20 (embed)
458    
459    libwpd (WordPerfect converter)
460            - openoffice.org <unfixed> (embed)
461    
462    fsplib (http://sourceforge.net/projects/fsp/)
463            - gftp <unfixed> (embed)
464            NOTE: lib/fsplib version 0.3
465    
466    sprng
467            - tree-puzzle <unfixed> (embed)
468    
469    librpcsecgss
470            - krb5 <unfixed> (embed)
471    
472    jasper
473            - ghostscript <unfixed> (embed)
474            - gs-gpl <unfixed> (embed)
475    
476    libiris
477            - psi <unfixed> (embed)
478            - kdenetwork <unfixed> (embed)
479            NOTE: kopete embeds libiris but links dynamically to libidn
480            - kdegames <unfixed> (embed)
481            NOTE: ksirk/kde4
482    
483    libidn
484            - monotone 0.43-1 (embed)
485            - psi <unfixed> (embed)
486            NOTE: psi embeds libiris which embeds libidn
487            - kdegames <unfixed> (embed)
488            NOTE: kdegames/kde4 embeds libiris which embeds libidn
489    
490    liblua
491            - monotone 0.43-1 (embed)
492            - nmap <unfixed> (embed; bug #527997)
493            NOTE: fixed upstream as of nmap svn rev13336.
494    
495    libbotan
496            - monotone 0.43-1 (embed)
497    
498    NetXX
499            - monotone 0.43-1 (embed)
500    
501    libgc
502            - mono <unfixed> (embed)
503    
504    lzma
505            - p7zip <unfixed> (embed)
506            - xz-utils <unfixed> (fork)
507    
508    lzo
509            - grub2 <unfixed> (embed)
510    
511    yassl
512            - mysql-dfsg-5.0 <unfixed> (embed)
513    
514    pax code
515            - tar <unfixed> (embed)
516            - cpio <unfixed> (embed)
517    
518    t1lib
519            - tetex-bin 2.0.2-1 (embed)
520            - texlive-bin <unknown> (embed)
521    
522    guichan
523            - boswars <unfixed> (embed)
524            NOTE: maintainer notified us, working on it
525    
526    tolua
527            - boswars <unfixed> (embed)
528            NOTE: maintainer notified us, working on it
529    
530    asio-dev
531            - luxrender <unfixed> (embed)
532            NOTE: maintainer notified us, working on it
533            NOTE: may be merged with boost "soon"
534    
535    xine-lib
536            - vlc <unfixed> (embed)
537            NOTE: only parts included in modules/access/rtsp
538    
539    netpbm
540            - tcl8.3 <unfixed> (embed)
541            - tcl8.4 <unfixed> (embed)
542            - tcl8.5 <unfixed> (embed)
543            NOTE: generic/tkImgGIF.c
544    
545    tk8.5
546            - tk8.0 <removed> (old-version)
547            - tk8.3 <unfixed> (old-version)
548            - tk8.4 <unfixed> (old-version)
549            - perl-tk <unfixable> (fork)
550    
551    samba
552            - mc 2:4.6.2~git20080311-1 (embed)
553            NOTE: maintainer is aware of this, currently searching a solution
554    
555    plib1.8.4c2
556            - boson <unfixed> (fork)
557            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
558    
559    fribidi
560            - quesoglc <unfixed> (embed)
561            NOTE: compiled against system fribidi in Debian - embed only used when fribidi is not available on the system
562    
563    glew
564            - quesoglc <unfixed> (embed; bug #489341)
565            NOTE: waiting on GLEW_MX version of glew (see bug #474488)
566    
567    minorGems (pabs contacted upstream about shared lib, he considers minorGems an 'ever-evolving collection of reusable code fragments' for his own use)
568            - transcend <unfixed> (embed)
569            - cultivation <unfixed> (embed)
570            - passage <unfixed> (embed)
571            - gravitation <unfixed> (embed)
572    
573    tar
574            - libarchive <unfixed> (embed)
575            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
576    
577    cpio
578            - libarchive <unfixed> (embed)
579            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
580    
581    webkit
582            - qt4-x11 <unfixed> (embed)
583    
584    ftgl
585            - blender 2.46+dfsg-1 (embed)
586    
587    wv
588            - abiword <unfixed>
589    
590    qemu
591            - kvm <unfixed> (embed; bug #543159)
592            - xen-3 <unfixed> (embed)
593            - xen-unstable <unfixed> (embed)
594    
595    vgabios
596            - kvm <unfixed> (embed; bug #489442)
597    
598    bochs
599            - kvm <unfixed> (embed; bug #489442)
600    
601    speex
602            - vorbis-tools <unfixed> (embed)
603            NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
604            - gst-plugins-good0.10 <unfixed> (embed)
605            - xine-lib <unfixed> (embed)
606            - libfishsound <unfixed> (embed)
607            - libannodex <unfixed> (embed)
608            - vlc <unfixed> (embed)
609            - xmms-speex <unfixed> (embed)
610            - libsdl-sound1.2 <unfixed> (embed)
611            - sweep <unfixed> (embed)
612    
613    libreadline
614            - magic <itp> (old-version)
615    
616    opcode
617            - ode <unfixed> (embed)
618            NOTE: opcode is not a package in debian, it is just embedded
619            NOTE: http://www.codercorner.com/Opcode.htm
620    
621    gimpact
622            - ode <unfixed> (embed)
623            NOTE: gimpact is not a package in debian, it is just embedded
624            NOTE: http://gimpact.sf.net
625    
626    mochikit
627            - mahara <unfixed> (embed)
628            NOTE: they require extra patches, still unmerged upstream
629            - ntop <unfixed> (embed)
630            - coherence <unfixed> (embed)
631            NOTE: python-coherence
632            - paste <unfixed> (embed)
633            NOTE: python-paste
634            - turbogears <unfixed> (embed)
635            NOTE: python-turbogears
636            - plone3 <unfixed> (embed)
637            NOTE: zope-plone3
638    
639    prototypejs
640            - netbeans-ide 6.0.1+dfsg-2 (embed)
641            - auth2db <unfixed> (embed)
642            - webcit <unfixed> (embed)
643            NOTE: citadel-webcit
644            - asterisk <unfixed> (embed)
645            - doc-iana <unfixed> (embed)
646            - libaws <unfixed> (embed)
647            NOTE: libaws-doc
648            - libgettext-ruby <unfixed> (embed)
649            NOTE: libgettext-ruby-data
650            - libjson-ruby <unfixed> (embed)
651            NOTE: libjson-ruby-doc
652            - lucene2 <unfixed> (embed)
653            NOTE: liblucene2-java-doc
654            - libopenid-ruby <unfixed> (embed)
655            - solr <unfixed> (embed)
656            NOTE: solr-common
657            - glpi <unfixed> (embed)
658            - mnemo2 <unfixed> (embed)
659            - nag2 <unfixed> (embed)
660            - knowledgeroot <unfixed> (embed)
661            - mediatomb <unfixed> (embed)
662            NOTE: mediatomb-common
663            - mt-daapd <unfixed> (embed)
664            - op-panel <unfixed> (embed)
665            - ebug-http <unfixed> (embed)
666            - phpgedview <removed> (embed)
667            - poker-network <unfixed> (embed)
668            NOTE: poker-web
669            - webhelpers <unfixed> (embed)
670            NOTE: python-webhelpers
671            - qwik <unfixed> (embed)
672            - rails <unfixed> (embed)
673            - typo3-src <unfixed> (embed)
674            - wordpress 2.5.0-2 (embed)
675            - zope <unfixed> (embed)
676            NOTE: zope-plone3
677            - smokeping <unfixed> (embed)
678            - ampache 3.4.1-2 (embed)
679            - exaile <unfixed> (embed)
680            - hobix <unfixed> (embed)
681            - pixelpost <unfixed> (embed)
682            - symfony <unfixed> (embed)
683            NOTE: it's been said that there are custom changes
684            - zabbix <unfixed> (embed)
685            NOTE: zabbix-frontend-php
686            - turba2 <unfixed> (embed)
687    
688    gdb
689            - insight <unfixed> (embed)
690    
691    e2fsprogs
692            - ldiskfsprogs <unfixable> (fork)
693    
694    quazip (not packaged in Debian)
695            - qcake <unfixed> (embed)
696            NOTE: starting with upstream version 0.6.4
697    
698    exo
699            - pcmanfm <unfixed> (embed; bug #499677)
700            NOTE: slightly modified source code
701    
702    java
703            - openjdk-6 <unfixed>
704            - sun-java5 <unfixed>
705            - sun-java6 <unfixed>
706    
707    libphp-snoopy
708            - ampache 3.4.1-2 (embed; bug #504169)
709            - mahara 1.0.5-2 (embed; bug #504170)
710            - pixelpost 1.7.1-5 (embed; bug #504171)
711            - mediamate 0.9.3.6-5 (embed; bug #504172)
712            - opendb <removed> (embed; bug #504173)
713            [etch] - opendb <unfixed> (embed; bug #504173)
714            - wordpress 2.5.1-9 (embed; bug #443948)
715            - moodle <unfixed> (embed; bug #507185)
716            [etch] - phpgroupware <unfixed> (embed)
717            NOTE: phpgroupware-felamimail
718            - magpierss 0.72-3 (embed; bug #431089)
719    
720    jquery
721            - zekr <unfixed> (embed)
722            - wordpress <unknown> (embed)
723            - yocto-reader <unfixed> (embed)
724            - textpattern <unfixed> (embed)
725            - genshi 0.5.1-1 (embed)
726            NOTE: compressed file under examples/ dir
727            - prewikka <unfixed> (embed)
728            - libramaze-ruby <unfixed> (embed)
729            - drupal5 <unfixed> (embed)
730            - b2evolution <unfixed> (embed)
731            - wesnoth <unfixed> (embed)
732    
733    tablesorter (jquery plugin, not packaged yet)
734            - wesnoth <unfixed> (embed)
735    
736    kses
737            - wordpress <unfixed> (embed; bug #504242)
738            NOTE: their copy has all methods renamed to wp_<foo>
739            NOTE: kses isn't in Debian, RFP: #504240
740            - moodle <unfixed> (embed; bug #507185)
741            - egroupware <unfixed> (embed)
742    
743    magpierss
744            - wordpress <unfixed> (embed; bug #504242)
745            - moodle <unfixed>
746    
747    php-gettext
748            - wordpress 2.8.4-1 (embed; bug #504242)
749    
750    libphp-ixr (name may change, it is the Incutio XML-RPC)
751            - wordpress <unfixed> (embed; bug #504242)
752            NOTE: libphp-ixr isn't in Debian, RFP: #504236
753            - dokuwiki <unfixed> (embed)
754            - textpattern <unfixed> (embed)
755    
756    libphp-cas
757            - glpi <unfixed> (embed)
758            - moodle <unfixed> (embed; bug #505984)
759    
760    scriptaculous
761            - glpi <unfixed> (embed)
762            - libaws <unfixed> (embed)
763            NOTE: libaws-doc
764            - op-panel <unfixed> (embed)
765            - symfony <unfixed> (embed)
766            NOTE: maintainer says there are extra incompatible changes required
767            - pixelpost <unfixed> (embed)
768            - webhelpers <unfixed> (embed)
769            NOTE: python-webhelpers
770            - qwik <unfixed> (embed)
771            - smokeping <unfixed> (embed)
772            - turba2 <unfixed> (embed)
773            - typo3-src 4.2.3-1 (embed)
774    
775    libmarkdown-php
776            - moodle <unfixed> (embed; bug #507185)
777            - pixelpost <unfixed> (embed)
778    
779    php-openid
780            - wordpress-openid <itp> (embed)
781    
782    geshi
783            - dokuwiki 0.0.20080505-3.1 (embed)
784            - pgfouine 1.0-1.1 (embed)
785            - websvn 2.1.0-1 (embed)
786    
787    webcalendar
788            - gforge 4.7~rc2-6 (embed; bug #504758)
789    
790    libical
791            - kdepim <unfixed> (fork)
792            - kdepimlibs <unfixed> (fork)
793            NOTE: fixed in KDE4 post 4.1.x series
794            - claws-mail-extra-plugins <unfixed> (fork)
795    
796    libltdl3
797            - kdelibs <unfixed> (embed)
798            NOTE: it's been said it sets RT_GLOBAL (or something like that) at runtime and version in experimental of libltdl can optionally set it
799            - synfig <unfixed> (embed)
800    
801    harfbuzz
802            - qt4-x11 <unfixed> (embed)
803    
804    libzip
805            - php5 <unfixed> (fork)
806            - odt2txt <unfixed> (embed; bug #523808)
807    
808    json.php (not packaged; should be replaced with php's built-in functions)
809            - moodle <unfixed>
810            - yui <unfixed>
811            - gallery2 <unfixed>
812            - dokuwiki <unfixed>
813            - typo3-src <unfixed>
814    
815    php-fpdf
816            - tcpdf <itp> (fork)
817            - moodle <unfixed>
818            - phpwiki <unfixed>
819            - egroupware <unfixed>
820            - ldap-account-manager <unfixed> (fork)
821    
822    tcpdf (itp: #495985)
823            - moodle <unfixed>
824            - phpmyadmin <unfixed>
825    
826    typo3
827            - moodle <unfixed>
828    
829    spreadsheet_writeexcel (PHP port of libspreadsheet-writeexcel-perl; itp: #487557)
830            - moodle <unfixed>
831            - gosa <unfixed>
832    
833    php-ole (itp: #487558)
834            - moodle <unfixed>
835    
836    pieforms (http://www.catalyst.net.nz)
837            - mahara <unfixed>
838    
839    savant2 (http://phpsavant.com)
840            - egroupware <unfixed>
841    
842    rssparser (http://nwow.org)
843            - egroupware <unfixed>
844            - phpgroupware <unfixed>
845    
846    lcms
847            - openjdk-6 <unfixed> (fork)
848    
849    libphp-phplayersmenu
850            - diogenes <unfixed>
851            - phpldapadmin <unfixed>
852    
853    libphp-pclzip
854            - docvert <unfixed>
855            - moodle <unfixed>
856            - egroupware <unfixed>
857    
858    libphp-simplepie
859            - dokuwiki <unfixed>
860    
861    libphp-jpgraph
862            - egroupware <unfixed>
863    
864    php-simpletest
865            - moodle <unfixed>
866    
867    libpng
868            - iceweasel <not-affected> (uses xulrunner)
869            - icedove 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1, 2.0.0.19-1 (embed)
870            - iceape 1.0.13~pre080614i-0etch1 (embed)
871            - xulrunner 1.9.0.13-1 (embed)
872            [lenny] - xulrunner 1.9.0.11-0lenny1
873            [etch] - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
874    
875    irssi
876            - silc-client <unfixed> (embed)
877            NOTE: Seems to be a pre-0.8.12 version that is used in irssi-plugin-silc
878    
879    extc
880            - mtasc <unfixed> (embed)
881            - haxe <unfixed> (embed)
882    
883    swflib
884            - mtasc <unfixed> (embed)
885            - haxe <unfixed> (embed)
886    
887    libitext-java
888            - bouncycastle 2.1.4-1 (embed)
889    
890    python-ply
891            - pyke <unfixed> (embed)
892    
893    libdumbnet (libdnet upstream)
894            - nmap <unfixed> (fork)
895    
896    gcc-4.4
897            - gcc-mingw32 <unfixed> (embed)
898    
899    camlimages
900            - advi <unfixed> (static; bug #550441)
901    
902    memcached
903            - memcachedb <unfixed> (embed)
904    
905    yajl
906            - argyll <unfixed> (embed; bug #544223)
907            NOTE: reference, confirmed by build logs: http://lists.debian.org/debian-mentors/2009/08/msg00062.html
908    
909    libept
910            - adept <unfixed> (embed; bug #540649)
911    
912    libvorbis
913            - iceweasel <not-affected> (uses xulrunner)
914            - xulrunner <not-affected> (introduced in 1.9.1)
915            TODO: recheck when xulrunner 1.9.1 enters unstable [- xulrunner <unfixed> (embed; bug #540959)]
916    
917    cairo
918            - iceweasel <not-affected> (uses xulrunner)
919            - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
920    
921    php-net-dnsbl
922            - serendipity <unfixed> (embed)
923    
924    php-onyx-rss
925            - serendipity <unfixed> (embed)
926    
927    php-text-wiki
928            - serendipity <unfixed> (embed)
929    
930    php-xml-rpc
931            - serendipity <unfixed> (embed)
932    
933    polarssl (does not have a shared library)
934            - pdkim <itp> (embed; bug #543150)
935            - xyssl <unfixed> (old-version)
936    
937    pidgin
938            - gaim <removed> (old-version)
939    
940    icu
941            - webkit 1.0.1-1 (embed; bug #547214)
942            - texlive-bin <unfixed> (fork)
943            NOTE: texlive upstream working with icu upstream to merge their changes
944    
945    cyrus-imapd-2.2
946            - kolab-cyrus-imapd <unfixed> (fork)
947            - dovecot 1:1.2.1-1 (embed) [/dovecot-sieve/src/libsieve/*]
948    
949    python-cxx-dev
950            - freecad <unfixed> (embed; bug #547936)
951    
952    libzipios++-dev
953            - freecad <unfixed> (embed; bug #547941)
954    
955    linux-2.6
956            - kvm <unfixed> (embed; bug #549973) [./kernel/*]
957            - linux-kbuild-2.6 <unfixed> (embed; bug #550379) [./kbuild/*]
958            - kernel-source-2.6.8 <removed> (old-version)
959            - kernel-source-2.4.27 <removed> (old-version)
960            - kernel-source-2.4.24 <removed> (old-version)
961            - kernel-source-2.2.25 <removed> (old-version)
962            - kernel-source-2.2.20 <removed> (old-version)
963    
964    libfdt (not yet packaged separately for debian; http://www.jdl.com/software/)
965            - kvm <unfixed> (embed) [./libfdt/*]
966    
967    qweb (not packaged)
968            - ajaxterm <unfixed>
969    
970    opensaml2
971            - opensaml <removed> (old-version)
972    
973    shibboleth-sp2
974            - shibboleth-sp <removed> (old-version)
975    
976    tuxonice-userui
977            - suspend2-userui <removed> (old-version)
978    
979    expat
980            - w3c-www <unfixed> (embed; bug #551941) [./modules/expat/*]
981            - python-xml <unfixed> (embed; bug #551940) [./extensions/expat/*]
982    
983    xerces-c
984            - xerces-c2 <unfixed> (old-version)
985            - xerces27 <removed> (old-version)
986    
987  zlib code: (separate between 1.2 and 1.1)  md5 (RSA's version; not the gnu version provided by coreutils)
988  dpkg          - w3c-www <unfixed> (embed; bug #551942) [./modules/md5/*]
 rsync  
 mozilla-firefox  
 mozilla(?)  
 Linux kernels  
989    
990    enet
991            - sauerbraten <unfixed> (embed; #497194)
992    
993  libgadu/ekg:  eglibc
994  centericq          - glibc <removed> (old-version)
 gaim  
 kopete (ships the code, but links dynamically in the Debian package)  
 kadu (not packaged in Debian)  
 GNU gadu (not packaged in Debian)  
   
   
 xmlrpc: (which package is the "origin" of this code?)  
 drupal  
 phpgroupware  
 egroupware  
 phpwiki  
 php4 (php-pear, IIRC this was reorganized some weeks ago?)  
 tikiwiki (not packaged in Debian)  
   
   
 shtool: (affects build-time only)  
 mysql-ocaml  
 php4  
   
   
 mozilla:  
 mozilla-firefox  
 mozilla-thunderbird  
 nvu  
   
   
 xli:  
 xloadimage  
   
   
 lesstif: (beware: two different lesstif APIs supported in one package, 1.2 discarded upstream)  
 openmotif  
 xfree86/xorg (in libxpm, still the case with x.org?  
   
   
 kerberized apps with BSD origin:  
 krb4  
 krb5  
 heimdal  
   
   
 grip: (which pkg is the origin?)  
 libcdaudio  
 grip  
 gnome-vfs (vfs2 as well?)  
   
   
 fudforum:  
 phpgroupware-fudforum  
 egroupware-fudforum  
   
   
 cvs:  
 gcvs (at least an additional script is included, check if there's more)  
   
 pcre:  
 python  
 php4 (src included, but Debian package links dynamically)  
 analog (src included, but Debian package links dynamically)  
 libgoffice-1  
   
 tiff:  
 wxpythongtk (check, which debian pkg this is in)  
 older kdegraphics/kpdf releases < 3.3 embedded a copy  
   
 uudeview:  
 libconvert-uulib-perl  
   
 sqlite: (not affected by security vulnerabilities so far)  
 amarok  
   
 uudeview:  
 libconvert-uulib-perl  
   
 util-linux/mount:  
 loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb  

Legend:
Removed from v.2037  
changed lines
  Added in v.13116

  ViewVC Help
Powered by ViewVC 1.1.5