/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 2037 by jmm-guest, Sun Sep 18 10:11:02 2005 UTC revision 7696 by nion, Sat Dec 22 16:18:49 2007 UTC
# Line 1  Line 1 
1    Embedded code copies
2    ====================
3    
4  This file collects cases, where a source package embeds code from  This file collects cases, where a source package embeds code from
5  other projects, without linking dynamically:  other projects which is considered bad for fixing security flaws
6    because the fix needs to be applied in multiple source packages.
7    
8    Format:
9    <srcpkg> (<optional comment about srcpkg>)
10            - <embedding srcpkg> <status> (<sort>; bug #<number>)
11            NOTE: optional comments about the linkage of the embedding srcpkg
12    
13    status: version number fixing the embedded copy, <unfixed> or <unknown> if the version number can not be determined
14    sort: static/dynamic
15    
16    xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
17            - gpdf <unfixed>
18            NOTE: only present in sarge, has been replaced by evince in etch
19            - pdftohtml <unfixed>
20            NOTE: has been replaced by poppler-utils, only present in sarge/etch
21            - kdegraphics <unfixed> (static; bug #436164)
22            NOTE: the kpdf replacement in KDE 4 is using poppler
23            - tetex-bin 3.0-12 (dynamic)
24            NOTE: links to poppler
25            - texlive-bin <unknown> (dynamic)
26            NOTE: links to poppler
27            - koffice <unfixed> (static; bug #436163)
28            - libextractor 0.5.12-1 (static)
29            NOTE: libextractor is using its own pdf decoder
30            - libextractor 0.5.12-1 (dynamic)
31            NOTE: links to poppler
32            - pdfkit.framework 0.8-4 (dynamic)
33            NOTE: links to poppler
34            - ipe <unfixed> (static)
35            NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
36            - ruby-gnome2 <unknown> (dynamic)
37            NOTE: copy only present in source but links to poppler
38    
39    silc-toolkit:
40    silc-client (uses libsilc and libsilcclient)
41    
42  xpdf code: (some use xpdf 2, some xpdf 3)  dietlibc:
43  gpdf  ccontrol (links statically)
 pdftohtml  
 kdegraphics/kpdf  
 tetex-bin  
 cupsys (only older releases, recent ones use xpdf-utils, it's still present in the src, though)  
 poppler  
44    
45  zlib code: (separate between 1.2 and 1.1)  libiax:
46    iaxmodem
47    
48    zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
49  dpkg  dpkg
50  rsync  rsync (somehow derived code base)
51  mozilla-firefox  mono
52  mozilla(?)  mozilla(?)
53  Linux kernels  Linux kernels
54    pvpgn (links dynamically since 1.7.8-2)
55    mrtg (links dynamically since 2.12.2-1)
56    rpm
57    
58    libbz2:
59    dpkg (statically linked)
60    
61  libgadu/ekg:  libgadu/ekg:
62  centericq  centericq
63  gaim  gaim
64    pigdin (links dynamically against libgadu)
65  kopete (ships the code, but links dynamically in the Debian package)  kopete (ships the code, but links dynamically in the Debian package)
66  kadu (not packaged in Debian)  kadu (not packaged in Debian)
67  GNU gadu (not packaged in Debian)  GNU gadu (not yet packaged in Debian)
   
68    
69  xmlrpc: (which package is the "origin" of this code?)  xmlrpc: (which package is the "origin" of this code?)
70  drupal  drupal
# Line 31  phpgroupware Line 72  phpgroupware
72  egroupware  egroupware
73  phpwiki  phpwiki
74  php4 (php-pear, IIRC this was reorganized some weeks ago?)  php4 (php-pear, IIRC this was reorganized some weeks ago?)
 tikiwiki (not packaged in Debian)  
   
75    
76  shtool: (affects build-time only)  shtool: (affects build-time only)
77  mysql-ocaml  mysql-ocaml
78  php4  php4
79    
   
80  mozilla:  mozilla:
81  mozilla-firefox  mozilla-firefox
82  mozilla-thunderbird  mozilla-thunderbird
83  nvu  firefox (to be removed)
84    thunderbird (to be removed)
85    iceweasel
86    iceape
87    icedove
88    xulrunner
89    nvu (no longer in Debian)
90    
91  xli:  xli:
92  xloadimage  xloadimage
93    
94    lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
 lesstif: (beware: two different lesstif APIs supported in one package, 1.2 discarded upstream)  
95  openmotif  openmotif
96  xfree86/xorg (in libxpm, still the case with x.org?  xfree86/xorg (in libxpm)
   
97    
98  kerberized apps with BSD origin:  kerberized apps with BSD origin:
99  krb4  krb4
100  krb5  krb5
101  heimdal  heimdal
102    
   
103  grip: (which pkg is the origin?)  grip: (which pkg is the origin?)
104  libcdaudio  libcdaudio
105  grip  grip
106  gnome-vfs (vfs2 as well?)  gnome-vfs (vfs2 as well?)
107    
   
108  fudforum:  fudforum:
109  phpgroupware-fudforum  phpgroupware-fudforum
110  egroupware-fudforum  egroupware-fudforum (removed from egroupware after sarge)
   
111    
112  cvs:  cvs:
113  gcvs (at least an additional script is included, check if there's more)  gcvs (at least an additional script is included, check if there's more)
114    
115  pcre:  pcre:
116  python  all pythons
117  php4 (src included, but Debian package links dynamically)  php4 (src included, but Debian package links dynamically)
118  analog (src included, but Debian package links dynamically)  analog (src included, but Debian package links dynamically)
119  libgoffice-1  libgoffice-1
120    vfu (removed linking against embedded copy in 4.06-4.1; #450754)
121    tf5 (since 5.0beta7 the Debian package links dynamically)
122    monotone (including this starting from 0.37)
123    glib (2.14 series for gregex support, only for udeb, regular packag links dynamic)
124    apache2 (since 2.0.53-4 uses 040_link_external_pcre patch)
125    exim4 (since 4.10-0.srh20.12 uses 36_pcre patch to use external pcre)
126    yacas (<= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway)
127    gtamsanalyzer.app (links dynamically since 0.42-5)
128    
129  tiff:  tiff:
130  wxpythongtk (check, which debian pkg this is in)  wxpythongtk (check, which debian pkg this is in)
# Line 89  libconvert-uulib-perl Line 135  libconvert-uulib-perl
135    
136  sqlite: (not affected by security vulnerabilities so far)  sqlite: (not affected by security vulnerabilities so far)
137  amarok  amarok
138    monotone
139  uudeview:  iceweasel
 libconvert-uulib-perl  
140    
141  util-linux/mount:  util-linux/mount:
142  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb
143    
144    webmin:
145    usermin (only in sarge)
146    
147    sylpheed:
148    sylpheed-claws
149    
150    phpsysinfo:
151    egroupware
152    phpgroupware
153    
154    phpldapadmin:
155    egroupware (removed from egroupware after sarge)
156    
157    chmlib:
158    kchmviewer (ships the code but links dynamically)
159    
160    libavcodec/libavformat (source: ffmpeg):
161    mplayer (#395252)
162    xvidcap
163    kino (links statically, does not include code)
164    vlc (links statically, does not include code)
165    smilutils (links statically, does not include code)
166    motion (links statically, does not include code)
167    gst-ffmpeg
168    gstreamer0.10-ffmpeg
169    xmovie
170    
171    mad MPEG decoding lib:
172    mad
173    xine-lib
174    
175    libdts:
176    libdts
177    xine-lib
178    
179    flac:
180    flac
181    xine-lib
182    
183    liba52:
184    a52dec
185    xine-lib
186    
187    libmpeg2:
188    mpeg2dec
189    xine-lib
190    
191    curl:
192    wget (code for NTLM authentication)
193    
194    TODO evaluate:
195    gimp-gap (potentially using ffmpeg code as well)
196    
197    uw-imap:
198    pine
199    alpine
200    
201    imagemagick:
202    graphicsmagick
203    
204    halibut:
205    nsis
206    
207    libghttp:
208    hotway
209    
210    libsndfile:
211    ardour
212    
213    glibmm2.4:
214    ardour
215    
216    libgnomecanvasmm2.6:
217    ardour
218    
219    libsigc++-2.0:
220    ardour
221    
222    soundtouch:
223    ardour
224    
225    libmms:
226    xine-lib
227    mimms
228    
229    FCKeditor: (packaged as fckeditor)
230    knowledgeroot
231    moin (452599)
232    karrigell (452598)
233    gforge-plugins-extra (fixed since 4.6.99+svn6225-1)
234    
235    
236    
237    Moodle contains lots of things:
238    AdoDB
239    AdoDB-XML Schema
240    ipatlas
241    PHPMailer
242    Smarty
243    htmlArea
244    TinyMCE
245    bennu
246    
247    TinyMCE:
248    wordpress
249    moodle
250    knowledgeroot
251    joomla (ITP)
252    
253    scintilla:
254    scite
255    qscintilla
256    qscintilla2
257    geany
258    
259    libphp-adodb:
260    gallery2
261    phppgadmin
262    egroupware
263    phpwiki
264    ipplan
265    typo3
266    moodle
267    cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)
268    
269    gzip:
270    linux-kernel (lib/inflate.c)
271    klibc (based on linux-kernel gzip code)
272    busybox
273    
274    neon:
275    cadaver (all, but being worked on: #188381)
276    gnome-vfs2 (#395874)
277    litmus (#395875)
278    screem (sarge only)
279    sitecopy (#395876)
280    tla (etch/sid only: #395877)
281    
282    libmodplug:
283    gst-plugins-bad0.10
284    
285    libvncserver:
286    vino
287    
288    putty:
289    filezilla
290    
291    tinyxml (not packaged in Debian):
292    filezilla
293    
294    gv:
295    evince (ps/ tree from gv 3.5.8)
296    evince-gtk (not packaged in Debian)
297    
298    libXbae:
299    libpawlib2-lesstif package (from Cernlib)
300    
301    libXaw:
302    libpawlib2-lesstif package (from Cernlib)
303    
304    (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)
305    
306    libgd2:
307    graphviz (lib/gd seems to be 2.0.33)
308    
309    rar:
310    unrar-nonfree
311    
312    unrar-free: (maybe this code is derived from the original rar, too?)
313    clamav (seems to be disabled in default config)
314    
315    mplayer (DirectMedia Object loader):
316    xine-lib (src/libw32dll/)
317    vlc (modules/codec/dmo/)
318    
319    libwpd (WordPerfect converter):
320    openoffice.org
321    
322    fsplib (http://sourceforge.net/projects/fsp/):
323    gftp (lib/fsplib version 0.3)
324    
325    librpcsecgss:
326    krb5
327    
328    jasper:
329    ghostscript
330    gs-gpl
331    
332    libidn:
333    monotone
334    
335    liblua:
336    monotone
337    
338    libbotan:
339    montone
340    
341    NetXX:
342    monotone
343    
344    libgc:
345    mono
346    
347    lzma:
348    p7zip
349    
350    lzo:
351    grub2
352    
353    pax code:
354    tar
355    cpio
356    
357    t1lib:
358    tetex-bin (links to system t1lib since 2.0.2)
359    texlive-bin (links to system t1lib)
360    
Legend:
Removed from v.2037  
changed lines
  Added in v.7696
  ViewVC Help
Powered by ViewVC 1.1.5