/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 2068 by jmm-guest, Wed Sep 21 08:53:12 2005 UTC revision 14826 by jmm-guest, Mon Jun 7 16:27:13 2010 UTC
# Line 1  Line 1 
1  This file collects cases, where a source package embeds code from  Embedded code copies
2  other projects, without linking dynamically:  ====================
3    
4  xpdf code: (some use xpdf 2, some xpdf 3)  This file collects source packages that embed code from other projects.
5  gpdf  This is considered bad for fixing security flaws because the fix needs
6  pdftohtml  to be applied in multiple source packages.
7  kdegraphics/kpdf  
8  tetex-bin  Format:
9  cupsys (only older releases, recent ones use xpdf-utils, it's still present in the src, though)  <srcpkg> (<optional comment about srcpkg>)
10  poppler          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11            NOTE: optional comments about the linkage of the embedding srcpkg
12    
13    status: version number fixing the embedded copy
14            <unfixed> if the issue is not yet fixed
15            <removed> if the package was removed from the archive
16            <itp> if the package is in the process of being packaged
17            <not-affected> if the package does not use the embedded copy
18            <unknown> if the version number can not be determined
19            <unfixable> for unavoidable cases (e.g., forks that add real value)
20    sort: static (linking statically against a lib)
21          embed (embeds a copy of the library into another source package)
22          modified-embed (embeds a code copy that differs from upstream code)
23          fork (a full-blown fork of another source package)
24          old-version (an older version of essentially the same code)
25    
26    The srcpkg might be some string to identify the code if there is no
27    specific source package.
28    
29    Everything up to the next line is ignored.
30    ---BEGIN
31    xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
32            NOTE: Fixed packages link to poppler library unless otherwise noted
33            - pdftohtml <unknown>
34            [sarge] - pdftohtml <unfixed>
35            [etch] - pdftohtml <unfixed>
36            NOTE: has been replaced by poppler-utils
37            - kdegraphics 4:4.2.2-1 (embed; bug #436164)
38            - texlive-base 3.0-12 (embed)
39            - texlive-bin 2007-1 (embed)
40            - koffice 1:2.0.0-1 (embed; bug #436163)
41            - libextractor 0.5.12-1 (embed)
42            NOTE: libextractor is using its own pdf decoder now
43            - ipe <unfixed> (embed)
44            NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
45            - ruby-gnome2 <unknown> (embed)
46            - pdfedit <unfixed> (embed; bug #510794)
47            - swftools <removed> (embed; bug #551293)
48            - poppler <unfixable> (fork)
49    
50    ppmd
51            - libcomplearn-mod-ppmd <unfixed> (fork)
52            NOTE: discussion in #458152
53    
54    libevent
55            - transmission 1.71-1 (embed; bug #529372)
56    
57    lrmi
58            - read-edid 2.0.0-1 (embed; bug #495131)
59            - s3switch <unfixed> (embed)
60            - xresprobe <unfixed> (embed)
61            - zhcon <unfixed> (embed)
62    
63    peercast
64            - gnome-peercast <removed> (embed)
65            [etch] - gnome-peercast <unfixed> (embed)
66    
67    silc-toolkit
68            - silc-client 1.1~beta6-1 (embed)
69    
70    icclib
71            - ghostscript <unfixed> (embed)
72            - argyll <unfixed> (embed)
73    
74    libusb
75            - argyll <unfixed> (embed)
76    
77    dietlibc
78            - ccontrol 0.9.1+20071204-1 (static)
79    
80    libmikmod
81            - sdl-mixer1.2 <unfixed> (embed)
82            TODO: report bug
83    
84    libiax
85            - iaxmodem <unfixable> (embed; bug #548885)
86    
87    spandsp
88            - iaxmodem <unfixable> (embed; bug #548885)
89    
90    python-paramiko
91            - fabric 0.9.0-2 (embed; bug #561398)
92    
93    zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
94            - dpkg 1.15.6 (static)
95            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
96            - rsync <unfixed> (embed)
97            - cherokee <unfixed> (embed)
98            NOTE: somehow derived code base
99            - mono <unfixed> (embed)
100            TODO: check mozilla
101            - Linux kernels <unfixed> (embed)
102            - pvpgn 1.7.8-2 (embed)
103            - mrtg 2.12.2-1 (embed)
104            - rpm <unknown> (embed)
105            NOTE: pinged anibal since when rpm was fixed
106            - tuxcmd-modules <unfixed> (embed)
107            - zsync <unfixed>
108            - tra <unfixed>
109            - sash <unfixed>
110            - nsis <unfixed>
111            - mseide-msegui <unfixed>
112            NOTE: mseide
113            - mirrordir <unfixed>
114            - poco <unfixed>
115            - klibc <unfixed>
116            - emboss <unfixed>
117            - ghostscript <unfixed>
118            - freeimage <unfixed>
119            - clamav <unfixed> (fork)
120            NOTE: from the changelog: "libclamav6 does indeed duplicate parts of the zlib code, but there is not way around that"
121            - tuxonice-userui <unfixed> (static)
122            - plt-scheme <unfixed>
123            - perl <unfixed>
124            - paraview <unfixed>
125            - velvet 0.7.56~nozlibcopy-1
126            - gcvs <unfixed>
127            - dump <unfixed>
128            - aide <unfixed> (static)
129            - dar <unfixed> (static)
130            - avfs <unfixed>
131            - fpc <unfixed>
132            - winff <unfixed>
133            NOTE: inherited from fpc, see #472304
134            - lazarus <unfixed>
135            NOTE: inherited from fpc, see #472304
136            - erlang <unfixed> (embed)
137            - gamera 3.2.3-1 (embed)
138            - python2.4 <unfixed> (embed; bug #553403)
139            - python2.5 <unfixed> (embed; bug #553403)
140            - texlive-bin <unknown> (embed)
141    
142    dulwich
143            - hg-git 0.1.0-1 (embed; bug #541996)
144    
145    libvigraimpex
146            - hugin <unfixed> (embed; bug #542259)
147            - enblend-enfuse <unfixed> (embed; bug #542258)
148            - gamera 3.2.3-1 (embed)
149    
150    libbz2
151            - dpkg 1.15.6 (static)
152            - amd64-libs <unfixed> (static)
153            NOTE: let's call it "static"
154            - dar <unfixed> (static)
155            - dump <unfixed> (static)
156            - unalz <unfixed> (embed)
157            NOTE: has code, by the maint, to use the system version but links against the internal copy
158    
159    libyahoo2
160            - centerim <unfixed> (embed; bug #559783)
161    
162    libmsn
163            - centerim <unfixed> (embed; bug #559783)
164    
165    libgadu
166            - centerim <unfixed> (embed; bug #559783)
167            - pidgin <not-affected> (links dynamically since initial release; fixed in gaim)
168            - gaim 1:2.0.0+beta3-3 (embed; bug #360280)
169            - kdenetwork 4:3.3.2-5 (embed)
170            NOTE: from kdenetwork: kopete
171            - ekg 1:1.8~rc0-1 (embed)
172            - kadu 0.6.0.2-3 (embed; bug #504430)
173            - gadu <itp> (embed)
174    
175    xmlrpc (which package is the "origin" of this code?)
176            - drupal <unfixed> (embed)
177            - phpgroupware <unfixed> (embed)
178            - egroupware <unfixed> (embed)
179            - phpwiki <unfixed> (embed)
180            - php4 <removed> (embed)
181            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
182    
183    shtool (affects build-time only)
184            - mysql-ocaml <unfixed> (embed)
185            - php4 <removed> (embed)
186            - php5 <unfixed> (embed)
187    
188    xulrunner
189            - iceape <unfixed> (embed; bug #561749)
190            - iceweasel 2.0.0.19 (embed)
191            - icedove <unfixed> (embed; bug #561750)
192            - kompozer <unfixed> (embed; bug #532168)
193            - galeon 2.0.2-4 (embed)
194            - epiphany-browser 2.14.3-8 (embed)
195            - conkeror 0.9~git080629-2 (embed)
196            - kazehakase 0.4.2-1 (embed)
197    
198    xli
199            - xloadimage <unfixed> (embed)
200    
201    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
202            - openmotif <unfixed> (embed)
203            - libxpm <unfixed> (embed; bug #575750)
204    
205    kerberized apps with BSD origin
206            - krb4 <removed> (embed)
207            - krb5 <unfixed> (embed)
208            - heimdal <unfixed> (embed)
209    
210    grip (which pkg is the origin?)
211            - libcdaudio <unfixed>
212            - grip <unfixed>
213            - gnome-vfs <unfixed>
214            TODO: check vfs2 as well
215    
216    fudforum
217            [etch] - phpgroupware <unfixed> (embed)
218            NOTE: phpgroupware-fudforum
219            [sarge] - egroupware-fudforum <removed> (embed)
220    
221    libbsd
222            - rdate 1:1.2-3 (embed)
223            - atheme-services <unfixed>
224            - libbsd-arc4random-perl <unfixed>
225            - isakmpd <unfixed>
226            - bsdgames <unfixed> (embed)
227            - bsd-mailx <unfixed> (embed)
228            - netcat-openbsd <unfixed> (embed; bug #550611)
229            - openssh <unfixed> (embed)
230            - unworkable <unfixed> (embed)
231    
232    cvs
233            - gcvs <unfixed> (embed)
234            NOTE: see cvsunix/src in tarball
235    
236    pcre3
237            - php4 <removed> (embed)
238            - analog 2:5.23-0woody1 (embed)
239            - goffice <unfixed> (embed)
240            NOTE: libgoffice-*
241            - vfu 4.06-4.1 (embed; bug #450754)
242            - tf5 5.0beta7-1 (embed)
243            - monotone 0.43-1 (embed)
244            NOTE: this only affects versions >= 0.37
245            - glib2.0 2.15.2-1 (embed)
246            - apache2 2.0.53-4 (embed)
247            - exim4 4.10-0.srh20.12 (embed)
248            - yacas <unfixed> (embed)
249            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
250            - gtamsanalyzer.app 0.42-5 (embed)
251            - tin 980117-1 (embed)
252            - kazehakase 0.5.2-1
253            - webkit 1.0.1-1 (embed)
254            - qt4-x11 <unfixed> (embed)
255            NOTE: embedded via webkit copy
256            - erlang <unfixed> (embed)
257            - ssed <unfixed> (embed)
258            - ircd-hybrid <unfixed> (static)
259            - emboss <unfixd>
260            - cherokee <unfixed> (embed)
261            - oftc-hybrid <unfixed> (embed)
262            - ratbox-services <unfixed> (embed)
263            - squeak-vm <unfixed> (embed)
264            - tinymux <unfixed> (embed)
265    
266    tiff
267            - wxwindows2.4 2.2.1 (embed)
268            - gamera 3.2.3-1 (embed)
269            - freeimage <unfixed> (embed)
270            - libtk-img <unfixed> (embed)
271            NOTE: there are two copies, one under tiff/ other under libtiff/
272            - gdal <unfixed>
273    
274    uudeview
275            - libconvert-uulib-perl <unfixed> (embed)
276            - pan <unfixed> (embed)
277    
278    sqlite (not affected by security vulnerabilities so far)
279            - amarok <unfixed> (embed)
280            - monotone 0.43-1 (embed)
281            - iceweasel <unfixed> (embed)
282            - heimdal <unfixed> (embed; bug #559616)
283    
284    util-linux/mount
285            - loop-aes-utils <unfixed> (embed)
286            NOTE: contains code from util-linux' mount in the mount-aes-udeb
287    
288    sylpheed
289            - sylpheed-claws <unfixed> (fork)
290    
291    phpsysinfo
292            - egroupware <unfixed> (embed)
293            - phpgroupware <unfixed> (embed)
294    
295    phpldapadmin
296            [sarge] - egroupware <unfixed> (embed)
297            NOTE: removed from egroupware after sarge
298    
299    chmlib
300            - kchmviewer <unknown> (embed)
301    
302    ffmpeg (libavcodec/libavformat)
303            - mplayer 1.0~rc2-14 (embed; bug #395252)
304            - kino 1.0.0-1
305            - vlc <not-affected> (Links dynamically since initial release)
306            - smilutils 0.3.0-10
307            NOTE: smilutils likely fixed earlier, marking Etch's version as fixed
308            - motion 3.1.19-1
309            - gstreamer0.10-ffmpeg 0.10.3-2
310            - xmovie <removed> (static)
311            TODO: gimp-gap (potentially using ffmpeg code as well)
312            - avifile 1:0.7.48~20090503.ds-1 (embed; bug #538750)
313            - audacity 1.3.7-2 (embed; bug #512278)
314    
315    faad2
316            - mplayer 1.0~rc2-20 (embed)
317            - avifile <unfixed> (embed; bug #538750)
318            - ffmpeg-debian <removed> (embed)
319    
320    libmad (MPEG decoding lib)
321            - xine-lib <unfixed> (embed)
322            - avifile 1:0.7.48~20090503.ds-1 (embed) [./plugins/libmad/*]
323            TODO: check ocaml-mad, madplay, pymad, xmms-mad, xmms2
324    
325    libdts
326            - xine-lib <unfixed> (embed)
327    
328    flac
329            - xine-lib <unfixed> (embed)
330    
331    liba52
332            - a52dec <unfixed> (embed)
333            - xine-lib <unfixed> (embed)
334    
335    mpeg2dec (libmpeg2)
336            - xine-lib <unfixed> (embed)
337    
338    libmpeg3
339            - squeak-vm <unfixed> (embed)
340    
341    libntlm
342            - wget <unfixed> (fork; bug #550436)
343            - curl <unfixed> (fork; bug #550437)
344            - cntlm <unfixed> (fork; bug #550438)
345    
346    uw-imap
347            - pine <unfixed> (embed)
348            - alpine <unfixed> (embed)
349    
350    imagemagick
351            - graphicsmagick <unfixed> (fork)
352    
353    python-urlgrabber
354            - mercurial <unfixed> (embed; bug #531062)
355            - w3af <unfixed> (embed; bug #555372)
356            [experimental] - harvestman <unfixed> (embed; bug #555373)
357    
358    beautifulsoup
359            - python-mechanize <unfixed> (embed; bug #555349)
360            - zope2.11 <removed> (embed; bug #555350)
361            - twill <unknown> (embed)
362    
363    halibut
364            - nsis <unfixed> (fork)
365    
366    libghttp
367            - hotway <unfixed> (embed)
368    
369    libsndfile
370            - ardour 1:2.7.1-1 (embed)
371    
372    glibmm2.4
373            - ardour 1:2.7.1-1 (embed)
374    
375    libgnomecanvasmm2.6
376            - ardour 1:2.7.1-1 (embed)
377    
378    libsigc++-2.0
379            - ardour 1:2.7.1-1 (embed)
380    
381    soundtouch
382            - ardour 1:2.7.1-1 (embed)
383    
384    libmms
385            - xine-lib <unfixed> (embed)
386            - mimms <unfixed> (embed)
387    
388    fckeditor
389            - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
390            - moin 1.8.2-2 (embed; bug #452599)
391            - karrigell <removed> (embed; bug #452598)
392            - gforge 4.6.99+svn6225-1 (embed)
393            - request-tracker3.8 <unfixed> (embed)
394            - otrs2 <unfixed> (embed)
395    
396    ipatlas (not packaged in Debian)
397            - moodle <unfixed> (embed; bug #507185)
398    
399    libphp-phpmailer
400            - moodle <unfixed> (embed; bug #507185)
401            - mahara <unfixed> (embed)
402            - symfony <unfixed> (embed; bug #566778)
403            [etch] - phpgroupware <unfixed> (embed)
404            NOTE: phpgroupware-felamimail is only in etch
405            - egroupware <unfixed> (embed; bug #504283)
406            - glpi <unfixed>
407    
408    htmlArea (not packaged in Debian)
409            - moodle <unfixed> (embed)
410    
411    giflib
412            - wine <unfixed> (embed; bug #466181)
413    
414    bennu (not packaged in Debian, http://bennu.sourceforge.net)
415            - moodle <unfixed> (embed)
416    
417    smarty
418            - moodle 1.8.2-2 (embed; bug #471158)
419            - gallery2 2.2.5-2 (embed; bug #471160)
420            - mahara 0.9.2-2 (embed; bug #471201)
421            - gosa 2.4beta1-1 (embed; bug #471200)
422    
423    TinyMCE
424            - wordpress 2.5.1-3 (embed; bug #478257)
425            - moodle <unfixed> (embed; bug #507185)
426            - knowledgeroot <unfixed> (embed)
427            - joomla <itp> (bug #326398)
428    
429    scintilla (upstream provides static lib, rejected shared lib http://sf.net/support/tracker.php?aid=2488121)
430            - scite <unfixed> (embed)
431            - qscintilla <unfixed> (embed)
432            - qscintilla2 <unfixed> (embed)
433            - geany <unfixed> (fork)
434            - anjuta <unfixed> (embed)
435    
436    libphp-adodb
437            - moodle <unfixed> (embed; bug #507185)
438            NOTE: also AdoDB-XML Schema
439            - gallery2 <unfixed> (embed)
440            - phppgadmin <unfixed> (embed)
441            - egroupware <unfixed> (embed)
442            - phpwiki <unfixed> (embed)
443            - torrentflux 2.0beta1-2 (embed)
444            - ipplan <unfixed> (embed)
445            - typo3-src <unfixed> (embed)
446            - cacti <unknown> (embed)
447            [sarge] - cacti <unfixed> (embed)
448            NOTE: dependency exists, but internal version is used
449            - gforge 4.7~rc2-6 (embed)
450            - mahara <unfixed> (embed)
451    
452    gzip
453            - linux-2.6 <unfixed> (embed) [lib/inflate.c]
454            - klibc <unfixed> (embed)
455            NOTE: based on linux-kernel gzip code
456            - busybox <unfixed> (embed)
457            - pristine-tar <unfixed> (modified-embed)
458            NOTE: compression code only, not uncompression
459    
460    neon
461            - cadaver 0.22.3+debian-1 (embed; bug #188381)
462            - gnome-vfs2 <unfixed> (embed; bug #395874)
463            [etch] - litmus <unfixed> (embed; #395875)
464            - litmus <removed> (embed; #395875)
465            [sarge] - screem <unfixed> (embed)
466            - sitecopy 1:0.16.0-1 (embed; bug #395876)
467            [etch] - tla <unfixed> (embed; bug #395877)
468            [sarge] - tla <unfixed> (embed; bug #395877)
469    
470    libmodplug
471            - gst-plugins-bad0.10 0.10.10.2-1 (embed)
472    
473    libvncserver
474            - vino <unfixed> (embed)
475    
476    putty
477            - filezilla <unfixed> (embed)
478    
479    tinyxml (not packaged in Debian; itp bug #531968)
480            - filezilla <unfixed>
481            - crystalspace <unfixed> (embed)
482            - libwfut <unfixed> (embed)
483            - rarian <unfixed> (embed)
484            - bulletml <unfixed> (embed)
485            - pokerth <unfixed> (embed)
486            - qutecom <unfixed> (embed)
487            - sofa-framework <unfixed> (embed)
488            - yate <unfixed> (embed)
489            - antigrav <unfixed> (embed)
490            - balder2d <unfixed> (embed)
491            - cal3d <unfixed> (embed)
492            - criticalmass <unfixed> (embed)
493            - ember <unfixed> (embed)
494            - epiphany <unfixed> (embed)
495            - gambit <unfixed> (embed)
496            - noiz2sa <unfixed> (embed)
497            - ogre <unfixed> (embed)
498            - opencity <unfixed> (embed)
499            - openmovieeditor <unfixed> (embed)
500            - pouetchess <unfixed> (embed)
501            - tecnoballz <unfixed> (embed)
502            - trigger-rally <unfixed> (embed)
503            - xmoto <unfixed> (embed)
504            - mapnik <unknown> (embed)
505            NOTE: uses a different XML parser by default
506            - rrootage 0.23a-6 <embed>
507            NOTE: links to libbulltetml
508            - boson <unknown> (embed)
509            NOTE: the embedded code is unused
510    
511    gv
512            - evince <unfixed> (embed)
513            NOTE: ps/ tree from gv 3.5.8
514            NOTE: evince-gtk is affected (a component of evince source package)
515    
516    libXbae
517            - paw <removed> (embed)
518            [etch] - paw <unfixed> (embed)
519    
520    libgtkhtml
521            - claws-mail-extra-plugins <unfixed> (fork)
522    
523    libXaw
524            - paw <removed> (embed)
525            [etch] - paw <unfixed> (embed)
526            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
527    
528    libgd2
529            - graphviz <unfixed> (embed)
530            NOTE: lib/gd seems to be 2.0.33
531            - wml 2.0.11ds2-1 (embed)
532            - libwmf <unfixed> (embed)
533            NOTE: derived from gd 1.6.3
534            - texlive-bin 2009-1 (embed)
535    
536    rar
537            - unrar-nonfree <unfixed> (embed)
538    
539    unrar-free (maybe this code is derived from the original rar, too?)
540            - clamav <unfixed> (embed)
541            NOTE: seems to be disabled in default config
542    
543    mplayer (DirectMedia Object loader)
544            - xine-lib <unfixed> (embed)
545            NOTE: src/libw32dll/
546            - vlc <unfixed> (embed)
547            NOTE: modules/codec/dmo/
548            - mplayer 1.0~rc2-20 (embed)
549    
550    libwpd (WordPerfect converter)
551            - openoffice.org <unfixed> (embed)
552    
553    fsplib (http://sourceforge.net/projects/fsp/)
554            - gftp <unfixed> (embed)
555            NOTE: lib/fsplib version 0.3
556    
557    sprng
558            - tree-puzzle <unfixed> (embed)
559    
560    librpcsecgss
561            - krb5 <unfixed> (embed)
562    
563    jasper
564            - ghostscript 8.64~dfsg-2 (embed)
565    
566    libiris
567            - psi <unfixed> (embed)
568            - kdenetwork <unfixed> (embed)
569            NOTE: kopete embeds libiris but links dynamically to libidn
570            - kdegames <unfixed> (embed)
571            NOTE: ksirk/kde4
572    
573    libidn
574            - monotone 0.43-1 (embed)
575            - psi <unfixed> (embed)
576            NOTE: psi embeds libiris which embeds libidn
577            - kdegames <unfixed> (embed)
578            NOTE: kdegames/kde4 embeds libiris which embeds libidn
579    
580    lua5.1
581            - monotone 0.43-1 (embed)
582            - nmap 5.00-1 (embed; bug #527997)
583            [lenny] - nmap <unfixed> (embed; bug #527997)
584            - ocropus <unfixed> (embed)
585            - enigma <unfixed> (embed)
586            NOTE: requires lua built with C++
587            - freeciv <unfixed> (embed)
588            - spring <unfixed> (embed)
589    
590    libbotan
591            - monotone 0.43-1 (embed)
592    
593    NetXX
594            - monotone 0.43-1 (embed)
595    
596    libgc
597            - mono <unfixed> (embed)
598    
599    lzma
600            - p7zip <unfixed> (embed)
601            - xz-utils <unfixed> (fork)
602    
603    lzo
604            - grub2 <unfixed> (embed)
605    
606    yassl
607            - mysql-dfsg-5.0 <unfixed> (embed)
608            - mysql-dfsg-5.1 <unfixed> (embed)
609    
610    pax code
611            - tar <unfixed> (embed)
612            - cpio <unfixed> (embed)
613    
614    t1lib
615            - tetex-bin 2.0.2-1 (embed)
616            - texlive-bin <unknown> (embed)
617    
618    guichan
619            - boswars <unfixed> (embed)
620            NOTE: maintainer notified us, working on it
621    
622    tolua
623            - boswars <unfixed> (embed)
624            NOTE: maintainer notified us, working on it
625            NOTE: actually tolua++
626            - ocropus <unfixed> (embed)
627            NOTE: actually tolua++
628            - freeciv <unfixed> (embed)
629            NOTE: actually tolua++
630            - enigma <unfixed> (embed)
631    
632    asio-dev
633            - luxrender <removed> (embed)
634    
635    xine-lib
636            - vlc <unfixed> (embed)
637            NOTE: only parts included in modules/access/rtsp
638    
639    netpbm
640            - tcl8.3 <unfixed> (embed)
641            - tcl8.4 <unfixed> (embed)
642            - tcl8.5 <unfixed> (embed)
643            NOTE: generic/tkImgGIF.c
644    
645    tk8.5
646            - tk8.0 <removed> (old-version)
647            - tk8.3 <unfixed> (old-version)
648            - tk8.4 <unfixed> (old-version)
649            - perl-tk <unfixable> (fork)
650    
651    samba
652            - mc 2:4.6.2~git20080311-1 (embed)
653            NOTE: maintainer is aware of this, currently searching a solution
654    
655    plib1.8.4c2
656            - boson <unfixed> (fork)
657            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
658    
659    fribidi
660            - quesoglc 0.7.2-2 (embed)
661    
662    glew
663            - quesoglc <unfixed> (embed; bug #489341)
664            NOTE: waiting on GLEW_MX version of glew (see bug #474488)
665            - trigger 0.5.2.1-2 (embed)
666            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
667            - trigger-rally 0.5.2.1-2 (embed)
668            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
669    
670    minorGems (pabs contacted upstream about shared lib, he considers minorGems an 'ever-evolving collection of reusable code fragments' for his own use)
671            - transcend <unfixed> (embed)
672            - cultivation <unfixed> (embed)
673            - passage <unfixed> (embed)
674            - gravitation <unfixed> (embed)
675    
676    tar
677            - libarchive <unfixed> (embed)
678            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
679    
680    cpio
681            - libarchive <unfixed> (embed)
682            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
683    
684    kde4libs
685            - kdelibs <unfixable> (old-version)
686    
687    webkit
688            - qt4-x11 <unfixed> (embed; bug #479851)
689            [etch] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
690            - kde4libs <unfixable> (fork)
691            NOTE: kde4lib's khtml and webkit were forked from khtml (this tracking, which seems
692            NOTE: reversed genesis-wise, is used because of so much other stuff in kde4libs)
693    
694    ftgl
695            - blender 2.46+dfsg-1 (embed)
696    
697    wv
698            - abiword <unfixed>
699    
700    qemu
701            - kvm <removed> (embed; bug #543159)
702            - qemu-kvm <unfixed> (embed; bug #560853)
703            NOTE: kvm superceded by qemu-kvm, which is just user interface (no modules)
704            - xen-3 3.4.2-2 (embed; bug #560856)
705            - xen-unstable <unfixed> (embed; bug #560856)
706    
707    vgabios
708            - kvm <removed> (embed; bug #489442)
709            - qemu-kvm <unfixed> (embed)
710    
711    bochs
712            - kvm <removed> (embed; bug #489442)
713            - qemu-kvm <unfixed> (embed)
714    
715    speex
716            - vorbis-tools <unfixed> (embed)
717            NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
718            - gst-plugins-good0.10 <unfixed> (embed)
719            - xine-lib <unfixed> (embed)
720            - libfishsound <unfixed> (embed)
721            - libannodex <removed> (embed)
722            - vlc <unfixed> (embed)
723            - xmms-speex <unfixed> (embed)
724            - libsdl-sound1.2 <unfixed> (embed)
725            - sweep <unfixed> (embed)
726    
727    libreadline
728            - magic <itp> (old-version)
729    
730    opcode
731            - ode <unfixed> (embed)
732            NOTE: opcode is not a package in debian, it is just embedded
733            NOTE: http://www.codercorner.com/Opcode.htm
734    
735    gimpact
736            - ode <unfixed> (embed)
737            NOTE: gimpact is not a package in debian, it is just embedded
738            NOTE: http://gimpact.sf.net
739    
740    mochikit
741            - mahara <unfixed> (embed)
742            NOTE: they require extra patches, still unmerged upstream
743            - ntop <unfixed> (embed)
744            - coherence 0.6.2-1 (embed)
745            - paste <unfixed> (embed)
746            - turbogears <unfixed> (embed)
747            - plone3 <removed> (embed)
748            - xulrunner <unfixed> (embed)
749            - libjifty-plugin-chart-perl <unfixed> (embed)
750            - sabnzbdplus <unfixed> (embed)
751            - tgmochikit <unfixed> (embed)
752    
753    prototypejs
754            - netbeans-ide 6.0.1+dfsg-2 (embed)
755            - auth2db 0.2.5-2+dfsg-1 (embed; bug #555218)
756            - webcit <unfixed> (embed; bug #555219)
757            - asterisk 1:1.6.2.0~rc3-1 (embed)
758            - libjson-ruby 1.1.4-1 (embed; bug #555224)
759            - lucene2 2.9.1+ds1-2 (embed; bug #555226)
760            - horde3 <unfixed> (embed)
761            - knowledgeroot 0.9.9.5-1 (embed; bug #555230)
762            - mediatomb 0.12.0~svn2018-5 (embed; bug #555233)
763            - mt-daapd 0.9~r1696.dfsg-6lenny2 (embed)
764            - ebug-http <removed> (embed; bug #555236)
765            - libaws 2.7-1 (embed; bug #555222)
766            - phpgedview <removed> (embed)
767            - poker-network 1.7.6-1 (embed; bug #555238)
768            - rails 2.1.0-6 (embed)
769            - wordpress 2.5.0-2 (embed; bug #555243)
770            - zope <not-affected> (the prototypejs embed is not in any of the obvious zope packages, e.g. zope2.9, zope2.10, zope2.11, and zope3)
771            TODO: search through all of the other zope packages
772            - ampache 3.4.1-2 (embed)
773            - exaile 0.2.14+debian-2.1 (embed; bug #555245)
774            - hobix 0.5~svn20070319-4 (embed; bug #555247)
775            - zabbix 1.6.6-4 (embed; bug #555250)
776            - chora2 <unfixed> (embed; bug #555253)
777            - gollem <unfixed> (embed; bug # 555254)
778            - jscropperui 1.2.1-1 (embed; bug #555257)
779            - scriptaculous <not-affected> (uses system prototype.js since initial upload; bug #555260)
780            - ingo1 1.2.3+debian0-1 (embed; bug #555261)
781            - kronolith2 2.3.3+debian0-1 (embed; bug #555262)
782            - activeldap <unfixed> (embed)
783            - libv8 <not-affected> (contains a google-specific implementation of prototype.js)
784            - mantis 1.1.2+dfsg-1 (embed; bug #555265)
785            - otrs2 2.3.4-6 (embed; bug #555267)
786            - webcalendar 1.2~b1-2 (embed; bug #555269)
787            - redmine 0.9.0~svn2907-1 (embed; bug #555270)
788            - jifty 0.90519-1 (embed; bug #555271)
789            - jquery 1.4-1 (embed; bug #555272)
790            - passenger 2.2.5debian1-1 (embed; bug #555273)
791            - plone3 <removed> (embed; bug #555275)
792            - wesnoth <not-affected> (prototype.js not included in any of the binary packages; bug #555277)
793            - libhtml-prototype-perl 1.48-3 (embed; bug #538920)
794            - xulrunner <unfixed> (embed)
795            NOTE: included in iceweasel/xulrunner unit tests directory, so may not be security-relevant
796    
797    gdb
798            - insight <unfixed> (embed)
799    
800    e2fsprogs
801            - ldiskfsprogs <unfixable> (fork)
802    
803    quazip (not packaged in Debian)
804            - qcake <unfixed> (embed)
805            NOTE: starting with upstream version 0.6.4
806    
807    exo
808            - pcmanfm <unfixed> (embed; bug #499677)
809            NOTE: slightly modified source code
810    
811    java
812            - openjdk-6 <unfixed>
813            - sun-java5 <unfixed>
814            - sun-java6 <unfixed>
815    
816    libphp-snoopy
817            - ampache 3.4.1-2 (embed; bug #504169)
818            - gforge 4.6.99+svn6094-2 (embed)
819            - mahara 1.0.5-2 (embed; bug #504170)
820            - pixelpost 1.7.1-5 (embed; bug #504171)
821            - mediamate 0.9.3.6-5 (embed; bug #504172)
822            - opendb <removed> (embed; bug #504173)
823            [etch] - opendb <unfixed> (embed; bug #504173)
824            - wordpress 2.5.1-9 (embed; bug #443948)
825            - moodle <unfixed> (embed; bug #507185)
826            [etch] - phpgroupware <unfixed> (embed)
827            NOTE: phpgroupware-felamimail
828            - magpierss 0.72-3 (embed; bug #431089)
829    
830    jquery
831            - zekr <unfixed> (embed)
832            - wordpress <unknown> (embed)
833            - yocto-reader <unfixed> (embed)
834            - textpattern <unfixed> (embed)
835            - genshi 0.5.1-1 (embed)
836            NOTE: compressed file under examples/ dir
837            - prewikka <unfixed> (embed)
838            - libramaze-ruby <unfixed> (embed)
839            - drupal5 <unfixed> (embed)
840            - b2evolution <unfixed> (embed)
841            - wesnoth <unfixed> (embed)
842    
843    tablesorter (jquery plugin, not packaged yet)
844            - wesnoth <unfixed> (embed)
845    
846    kses
847            - wordpress <unfixed> (embed; bug #504242)
848            NOTE: their copy has all methods renamed to wp_<foo>
849            NOTE: kses isn't in Debian, RFP: #504240
850            - moodle <unfixed> (embed; bug #507185)
851            - egroupware <unfixed> (embed)
852    
853    magpierss
854            - wordpress <unfixed> (embed; bug #504242)
855            - moodle <unfixed>
856    
857    php-gettext
858            - wordpress 2.8.4-1 (embed; bug #504242)
859            - docbookwiki <unfixed> (embed)
860            - knowledgeroot 0.9.9.5-1
861            NOTE: non-free
862    
863    libphp-ixr (name may change, it is the Incutio XML-RPC)
864            - wordpress <unfixed> (embed; bug #504242)
865            NOTE: libphp-ixr isn't in Debian, RFP: #504236
866            - dokuwiki <unfixed> (embed)
867            - textpattern <unfixed> (embed)
868    
869    libphp-cas
870            - glpi <unfixed> (embed)
871            - moodle <unfixed> (embed; bug #505984)
872    
873    scriptaculous (prototype.js is among the embeds in the following)
874            - glpi <unfixed> (embed)
875            - libaws <unfixed> (embed; bug #555222)
876            - op-panel <unfixed> (embed)
877            - symfony <unfixed> (embed)
878            NOTE: maintainer says there are extra incompatible changes required
879            - pixelpost 1.7.1-6 (embed)
880            - webhelpers <unfixed> (embed)
881            - qwik <removed> (embed; bug #555241)
882            - smokeping <unfixed> (embed)
883            - turba2 <unfixed> (embed)
884            - typo3-src 4.2.3-1 (embed)
885            - request-tracker3.6 <unfixed> (embed)
886            - request-tracker3.8 <unfixed> (embed)
887            - rt-extension-emailcompletion <not-affected> (prototype.js not included in the binary package)
888            - wordpress 2.5.0-2 (embed)
889            - libhtml-prototype-perl 1.48-3 (embed)
890    
891    libmarkdown-php
892            - moodle <unfixed> (embed; bug #507185)
893            - pixelpost 1.7.1-6 (embed)
894    
895    php-openid
896            - wordpress-openid <itp> (embed)
897    
898    geshi
899            - dokuwiki 0.0.20080505-3.1 (embed)
900            - pgfouine 1.0-1.1 (embed)
901            - websvn 2.1.0-1 (embed)
902    
903    webcalendar
904            - gforge 4.7~rc2-6 (embed; bug #504758)
905    
906    libical
907            - kdepim <unknown> (fork)
908            NOTE: fixed at some point during 4.0
909            - kdepimlibs 4.2.0-1 (fork)
910            - claws-mail-extra-plugins <unfixed> (fork)
911    
912    harfbuzz
913            - qt4-x11 <unfixed> (embed)
914            - pango1.0 <unfixed> (embed)
915            - fontmatrix <unfixed> (embed)
916    
917    libzip
918            - php5 <unfixable> (modified-embed)
919            - odt2txt <unfixed> (embed; bug #523808)
920    
921    json.php (not packaged; should be replaced with php's built-in functions)
922            - moodle <unfixed>
923            - yui <unfixed>
924            - gallery2 <unfixed>
925            - dokuwiki <unfixed>
926            - typo3-src <unfixed>
927    
928    php-fpdf
929            - tcpdf <itp> (fork)
930            - moodle <unfixed>
931            - phpwiki <unfixed>
932            - egroupware <unfixed>
933            - ldap-account-manager <unfixed> (fork)
934    
935    tcpdf (itp: #495985)
936            - moodle <unfixed>
937            - phpmyadmin <unfixed>
938    
939    typo3
940            - moodle <unfixed>
941    
942    spreadsheet_writeexcel (PHP port of libspreadsheet-writeexcel-perl; itp: #487557)
943            - moodle <unfixed>
944            - gosa <unfixed>
945    
946    php-ole (itp: #487558)
947            - moodle <unfixed>
948    
949    pieforms (http://www.catalyst.net.nz)
950            - mahara <unfixed>
951    
952    savant2 (http://phpsavant.com)
953            - egroupware <unfixed>
954    
955    rssparser (http://nwow.org)
956            - egroupware <unfixed>
957            - phpgroupware <unfixed>
958    
959    lcms
960            - openjdk-6 <unfixed> (fork)
961            - gimp 2.4.0~rc2-2
962    
963    libphp-phplayersmenu
964            - diogenes <unfixed>
965            - phpldapadmin <unfixed>
966    
967    libphp-pclzip
968            - docvert <unfixed>
969            - moodle <unfixed>
970            - egroupware <unfixed>
971    
972    libphp-simplepie
973            - dokuwiki <unfixed>
974            - wordpress <unfixed>
975    
976    libphp-jpgraph
977            - egroupware <unfixed>
978    
979    php-simpletest
980            - moodle <unfixed>
981    
982    libpng
983            - iceweasel <not-affected> (uses xulrunner)
984            - icedove 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1, 2.0.0.19-1 (embed)
985            - iceape 1.0.13~pre080614i-0etch1 (embed)
986            - xulrunner 1.9.0.13-1 (embed)
987            [lenny] - xulrunner 1.9.0.11-0lenny1
988            [etch] - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
989            - gamera 3.2.3-1 (embed)
990            - freeimage <unfixed> (embed)
991            - tuxonice-userui (static)
992    
993    irssi
994            - silc-client <unfixed> (embed)
995            NOTE: Seems to be a pre-0.8.12 version that is used in irssi-plugin-silc
996    
997    extc
998            - mtasc <unfixed> (embed)
999            - haxe <unfixed> (embed)
1000    
1001    swflib
1002            - mtasc <unfixed> (embed)
1003            - haxe <unfixed> (embed)
1004    
1005    libitext-java
1006            - bouncycastle 2.1.4-1 (embed)
1007    
1008    python-ply
1009            - pyke <unfixed> (embed; bug #555363)
1010            - pywbem 0.7.0-4 (embed; bug #555364)
1011            - sepolgen <unfixed> (embed; bug #555365)
1012            - zope-textindexng3 <unknown> (embed)
1013            - iceweasel <not-affected> (uses xulrunner)
1014            - xulrunner <unknown> (embed)
1015            - wireshark <not-affected> (python-ply modules are not installed into binary packages; see #554613)
1016    
1017    libdumbnet (libdnet upstream)
1018            - nmap <unfixed> (fork)
1019    
1020    gcc-4.4
1021            - gcc-mingw32 <unfixed> (embed)
1022    
1023    camlimages
1024            - advi <unfixed> (static; bug #550441)
1025    
1026    memcached
1027            - memcachedb <unfixed> (embed)
1028    
1029    yajl
1030            - argyll <unfixed> (embed; bug #544223)
1031            NOTE: reference, confirmed by build logs: http://lists.debian.org/debian-mentors/2009/08/msg00062.html
1032    
1033    nusoap
1034            - gforge 4.8.2-1 (embed)
1035            - ampache <unfixed> (embed)
1036            - poker-network <unfixed> (embed)
1037            - moodle <unfixed> (embed)
1038            NOTE: code is not used when running under php5 and soap is enabled
1039            - phpwiki <unfixed> (embed)
1040            - gallery2 <unfixed> (embed)
1041            - typo3-src <unfixed> (embed)
1042    
1043    libept
1044            - adept <unfixed> (embed; bug #540649)
1045    
1046    libvorbis
1047            - iceweasel <not-affected> (uses xulrunner)
1048            - xulrunner <unfixed> (embed; bug #540959)
1049            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1050            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1051            - iceape <unfixed> (embed)
1052            [etch] - iceape <not-affected> (introduced in 2.0)
1053            [lenny] - iceape <not-affected> (introduced in 2.0)
1054    
1055    cairo
1056            - iceweasel <not-affected> (uses xulrunner)
1057            - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
1058    
1059    liboggz
1060            - iceweasel <not-affected> (uses xulrunner)
1061            - xulrunner <unfixed> (embed; bug #540959)
1062            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1063            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1064            - iceape <unfixed> (embed)
1065            [etch] - iceape <not-affected> (introduced in 2.0)
1066            [lenny] - iceape <not-affected> (introduced in 2.0)
1067    
1068    liboggplay
1069            - iceweasel <not-affected> (uses xulrunner)
1070            - xulrunner <unfixed> (embed; bug #540959)
1071            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1072            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1073            - iceape <unfixed> (embed)
1074            [etch] - iceape <not-affected> (introduced in 2.0)
1075            [lenny] - iceape <not-affected> (introduced in 2.0)
1076    
1077    php-net-dnsbl
1078            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1079    
1080    php-onyx-rss
1081            - serendipity <unfixed> (embed; bug #541740; wontfix: only one script, own package is overkill, appears not to be duplicated in Debian)
1082    
1083    php-text-wiki
1084            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1085    
1086    php-xml-rpc
1087            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1088    
1089    polarssl (does not have a shared library)
1090            - pdkim <itp> (embed; bug #543150)
1091            - xyssl <unfixed> (old-version)
1092    
1093    pidgin (libpurple)
1094            - gaim <removed> (old-version)
1095            - qutecom 2.2~rc3.hg396~dfsg1-6 (embed; bug #559785)
1096    
1097    icu
1098            - webkit 1.0.1-1 (embed; bug #547214)
1099            - texlive-bin <unfixed> (fork)
1100            NOTE: texlive upstream working with icu upstream to merge their changes
1101    
1102    cyrus-imapd-2.2
1103            - kolab-cyrus-imapd <unfixed> (fork)
1104            - dovecot 1:1.2.1-1 (embed) [/dovecot-sieve/src/libsieve/*]
1105    
1106    python-cxx-dev
1107            - freecad 0.9.2646.3-1 (embed; bug #547936)
1108    
1109    zipios++
1110            - freecad 0.9.2646.3-1 (embed; bug #547941)
1111            - enigma 0.92.3-3 (embed)
1112            NOTE: likely fixed earlier, marking etch's version as fixed
1113    
1114    linux-2.6
1115            - kvm <removed> (embed; bug #549973) [./kernel/*]
1116            - linux-kbuild-2.6 <unfixed> (embed; bug #550379) [./kbuild/*]
1117            - kernel-source-2.6.8 <removed> (old-version)
1118            - kernel-source-2.4.27 <removed> (old-version)
1119            - kernel-source-2.4.24 <removed> (old-version)
1120            - kernel-source-2.2.25 <removed> (old-version)
1121            - kernel-source-2.2.20 <removed> (old-version)
1122    
1123    libfdt (not yet packaged separately for debian; http://www.jdl.com/software/)
1124            - kvm <removed> (embed) [./libfdt/*]
1125            - qemu-kvm <unfixed> (embed) [./libfdt/*]
1126    
1127    qweb (not packaged)
1128            - ajaxterm <unfixed>
1129    
1130    opensaml2
1131            - opensaml <removed> (old-version)
1132    
1133    shibboleth-sp2
1134            - shibboleth-sp <removed> (old-version)
1135    
1136    tuxonice-userui
1137            - suspend2-userui <removed> (old-version)
1138    
1139    expat
1140            - w3c-libwww <removed> (embed; bug #551941)
1141            [etch] - w3c-libwww <unfixed> (embed; bug #551941) [./modules/expat/*]
1142            - python-xml <unfixed> (embed; bug #551940) [./extensions/expat/*]
1143            - python2.5 <unfixable> (embed; bug #553403) [./Modules/expat/*]
1144            - python2.4 <unfixable> (embed; bug #553403)
1145            - python-4suite <unfixed> (embed; bug #516935)
1146            - wxwindows2.4 <removed> (embed)
1147            - wxwidgets2.6 2.6.3.2.2-4 (embed)
1148            - wxwidgets2.8 2.8.10.1-2 (embed)
1149            - celementtree 1.0.5-8 (embed)
1150            NOTE: Maybe that was fixed even earlier
1151            - audacity 1.3.2-1 (embed)
1152            - matanza <unfixed> (embed)
1153            - tdom 0.8.3~20080525-1 (embed)
1154            - udunits 2.1.8-4 (embed)
1155            - apr-util 1.2 (embed)
1156            - ayttm <unfxed> (embed; bug #561006)
1157            - cableswig <unfixed> (embed)
1158            - cadaver <unfixed> (embed)
1159            - cmake 2.6.0-6 (embed)
1160            - coin3 <unfixed> (embed)
1161            - gdcm 2.0.14-2 (embed)
1162            - ghostscript 8.71~dfsg-2 (embed)
1163            - grmonitor <removed> (embed)
1164            - iceape <unfixed> (embed)
1165            - insighttoolkit 3.16.0-1 (embed)
1166            NOTE: insighttoolkit might've been fixed earlier
1167            - libparagui1.1 1.0.2-1 (embed)
1168            - paraview 3.6.2-1 (embed)
1169            - poco 1.3.6p1-1 (embed)
1170            - simgear <unfixed> (embed)
1171            - sitecopy 1:0.16.0-1
1172            - smart <unfixed> (embed)
1173            NOTE: smart embeds celementree, and it includes expat
1174            - swish-e <not-affected> (Linked against libxml, which is used instead)
1175            - tla 1.3.5+dfsg-15 (embed)
1176            - vtk 4.1.20030227-1 (embed)
1177            - wbxml2 <not-affected> (expat code is only used on Mac OS X, see #560941)
1178            - xmlrpc-c <unfixed> (embed)
1179            - iceweasel <unfixed> (embed)
1180            - kompozer <unfixed> (embed)
1181            - vxl 1.13.0-2 (embed)
1182            - xulrunner <unfixed> (embed)
1183            - apache2 2.2 (embed)
1184            - texlive-bin <not-affected> (Embedded code not compiled in)
1185            - vnc4 <unfixed> (embed)
1186            - xotcl 1.6.6-1 (embed)
1187    
1188    xerces-c
1189            - xerces-c2 <unfixed> (old-version)
1190            - xerces27 <removed> (old-version)
1191    
1192    md5 (RSA's version; not the gnu version provided by coreutils)
1193            - w3c-libwww <removed> (embed; bug #551942)
1194            [etch] - w3c-libwww <unfixed> (embed; bug #551942) [./modules/md5/*]
1195    
1196    libparagui1.1
1197            - asc <unfixable> (fork)
1198    
1199    enet
1200            - sauerbraten <unfixed> (embed; #497194)
1201    
1202    eglibc
1203            - glibc <removed> (old-version)
1204    
1205    galib
1206            - gamera 3.2.3-1 (embed)
1207    
1208    configobj
1209            - bzr 2.1.0~rc2-1 (embed; bug #555336)
1210            - elisa <unfixed> (embed; bug #555337)
1211            - gaupol <unfixed> (embed; bug #555338)
1212            - ipython <unfixed> (embed; bug #555339)
1213            - pida <unfixed> (embed; bug #555340)
1214            - psychopy <unfixed> (embed; bug #555341)
1215            - rest2web <unfixed> (embed; bug #555342)
1216            - auth2db <unknown> (embed)
1217            - dynagen <unknown> (embed)
1218            - iceweasel <unknown> (embed)
1219            - sabnzbdplus <unknown> (embed)
1220            - xulrunner <unknown> (embed)
1221            - nipy <not-affected> (part of an example [/examples/neurospin/neurospy/configobj.py], which is not installed into binary packages)
1222    
1223    python-clientform
1224            - bibus <unfixed> (embed; bug #555332)
1225            - zope2.10 <unfixed> (embed; bug #555333)
1226            - zope2.11 <removed> (embed; bug #555334)
1227            - python-mechanize <unknown> (embed)
1228            - twill <unknown> (embed)
1229    
1230    python-mechanize
1231            - zope2.10 <unfixed> (embed; bug #555337)
1232            - zope2.11 <removed> (embed; bug #555338)
1233            - twill <unknown> (embed; bug #555339)
1234    
1235    pexpect
1236            - duplicity 0.6.06-1 (embed; bug #555361)
1237            - hplip <unfixed> (embed; bug #555362)
1238            - smart <unfixed> (embed; bug #555363)
1239    
1240    pyparsing
1241            - bauble <unfixed> (embed; bug #555366)
1242            - boa-constructor 0.6.1-8 (embed; bug #555367)
1243            - calibre <unfixed> (embed; bug #555368)
1244            - matplotlib <unfixed> (embed; bug #531024)
1245            - zhpy 1.7.3.1-1 (embed; bug #555370)
1246            - polybori <unknown> (embed)
1247            - python-whoosh <unknown> (embed)
1248            - twill <unknown> (embed)
1249            - zope-textindexng3 <unknown> (embed)
1250    
1251    python-pysqlite2
1252            - python2.4 <unfixed> (embed; bug #553403)
1253            - python2.5 <unfixed> (embed; bug #553403)
1254    
1255    celementtree
1256            - python2.5 <unfixed> (embed)
1257            - smart <unfixed> (embed)
1258    
1259    elementtree
1260            - python2.5 <unfixed> (embed)
1261            - python2.6 <unfixed> (embed)
1262            - bzr 2.1.0~rc2-1 (embed; bug #555343)
1263            - gedit 2.28.2-1 (embed; bug #555344)
1264            - smart <unfixed> (embed)
1265            - solfege <unfixed> (embed; bug #555345)
1266            - w3af <unfixed> (embed; bug #555346)
1267            - python-qt4 <unknown> (embed)
1268            - sphinx <unknown> (embed)
1269            - python-nltk <itp> (embed)
1270    
1271    python2.5
1272            - python2.4 <unfixed> (old-version)
1273            - jython <unfixed> (embed)
1274            NOTE: embeds many stdlib modules
1275            - python-django <unfixed> (embed; bug #555419)
1276            NOTE: embeds stdlib modules: doctest, decimal
1277            - gamera 3.2.3-1 (embed)
1278            NOTE: embeds stdlib modules: ConfigParser, optparse, sets, textwrap
1279            - boa-constructor <unfixed> (embed; bug #555426)
1280            NOTE: embeds stdlib modules: ConfigParser, tarfile, zipfile, xmlrpclib
1281            - nicotine <unfixed> (embed; bug #555427)
1282            NOTE: embeds stdlib modules: ConfigParser
1283            - museek+ <unfixed> (embed; bug #555428)
1284            NOTE: embeds stdlib modules: ConfigParser
1285            - vegastrike-data <unfixed> (embed)
1286            NOTE: embeds many stdlib modules
1287            - codespeak-lib 1.1.1-1 (embed; bug #555420)
1288            NOTE: embeds stdlib modules: doctest, optparse, subprocess, textwrap
1289            - config-manager <unfixed> (embed; bug #555423)
1290            NOTE: embeds stdlib modules: optparse
1291            - jhbuild 2.28.0-1 (embed; bug #555421)
1292            NOTE: embeds stdlib modules: optparse, subprocess
1293            - smart <unfixed> (embed; bug #555432)
1294            NOTE: embeds stdlib modules: optparse
1295            - pyprotocols 1.0a.svn20070625-5 (embed; bug #555433)
1296            NOTE: embeds stdlib modules: doctest
1297            - ruledispatch 0.5a.svn20080510-4 (embed; bug #555434)
1298            NOTE: embeds stdlib modules: doctest
1299            - distribute <unfixed> (embed)
1300            NOTE: embeds stdlib modules: doctest
1301            - python-setuptools <unfixed> (embed; bug #555435)
1302            NOTE: embeds stdlib modules: doctest
1303            - zope.testing <unfixed> (embed; bug #555436)
1304            NOTE: embeds stdlib modules: doctest
1305            - translate-toolkit <unfixed> (embed; bug #555422)
1306            NOTE: embeds stdlib modules: textwrap, contextlib
1307            - libtpclient-py <unfixed> (embed; bug #555424)
1308            NOTE: embeds stdlib modules: subprocess
1309            - grass <unfixed> (embed; bug #555425)
1310            NOTE: embeds stdlib modules: subprocess
1311            - coherence <unfixed> (embed; bug #555429)
1312            NOTE: embeds stdlib modules: uuid
1313            - python-django-extensions 0.4.2pre+git200911182050-1 (embed; bug #555430)
1314            NOTE: embeds stdlib modules: uuid
1315            - setroubleshoot <unfixed> (embed; bug #555431)
1316            NOTE: embeds stdlib modules: uuid
1317            - linkchecker <unfixed> (embed; bug #555414)
1318            NOTE: embeds msgfmt.py script
1319            - imdbpy <unfixed> (embed)
1320            NOTE: embeds msgfmt.py script
1321            - kiwi <unfixed> (embed)
1322            NOTE: embeds msgfmt.py script
1323            - moin <unfixed> (embed)
1324            NOTE: embeds msgfmt.py script, stdlib modules: cgitb, difflib, tarfile
1325            - plone3 <removed> (embed)
1326            NOTE: embeds msgfmt.py script
1327            - roundup <unfixed> (embed)
1328            NOTE: embeds msgfmt.py script, stdlib modules: cgitb
1329            - rednotebook <unfixed> (embed; bug #555415)
1330            NOTE: embeds msgfmt.py script
1331            - turbogears <unfixed> (embed)
1332            NOTE: embeds msgfmt.py script
1333            - elisa <unfixed> (embed)
1334            NOTE: embeds msgfmt.py script, stdlib modules: uuid
1335            - calibre <unfixed> (embed)
1336            NOTE: embeds msgfmt.py script, stdlib modules: zipfile
1337            - mailman 1:2.1.13-1 (embed; #555416)
1338            NOTE: embeds msgfmt.py script
1339            - python-docutils <unknown> (embed)
1340            NOTE: embeds stdlib modules: optparse, textwrap
1341            - python-imaging <unknown> (embed)
1342            NOTE: embeds stdlib modules: doctest
1343            - python-mechanize <unknown> (embed)
1344            NOTE: embeds stdlib modules: doctest
1345            - twill <unknown> (embed)
1346            NOTE: embeds stdlib modules: subprocess
1347            - zeroc-ice <unknown> (embed)
1348            NOTE: embeds stdlib modules: subprocess
1349            - wxwidgets2.8 <unknown> (embed)
1350            NOTE: embeds stdlib modules: subprocess
1351            - cycle <unknown> (embed)
1352            NOTE: embeds msgfmt.py script
1353            - deluge <unknown> (embed)
1354            NOTE: embeds msgfmt.py script
1355            - opendict <unknown> (embed)
1356            NOTE: embeds msgfmt.py script
1357            - openerp-client <unknown> (embed)
1358            NOTE: embeds msgfmt.py script
1359            - rapidsvn <unknown> (embed)
1360            NOTE: embeds msgfmt.py script
1361            - wammu <unknown> (embed)
1362            NOTE: embeds msgfmt.py script
1363            - gaphor <unknown> (embed)
1364            NOTE: embeds msgfmt.py script
1365            - pida <unknown> (embed)
1366            NOTE: embeds msgfmt.py script
1367            - python-formencode <unknown> (embed)
1368            NOTE: embeds msgfmt.py script
1369            - duplicity <unfixed> (embed)
1370            NOTE: embeds stdlib module: urlparse, tarfile
1371            - pygopherd <unfixed> (embed)
1372            NOTE: embeds stdlib module: zipfile
1373    
1374    argparse
1375            - twill <unfixed> (embed; bug #555347)
1376            - ipython <unfixed> (embed; bug #555348)
1377    
1378    coherence
1379            - elisa <unfixed> (embed; bug #555335)
1380    
1381    simpletal
1382            - plastex <unfixed> (embed; bug #555371)
1383    
1384    flickrpc (not packaged in Debian, http://burtonini.com/bzr/flickrpc/)
1385            - postr <unfixed> (embed)
1386            - elisa <unfixed> (embed)
1387    
1388    simplegeneric (not packaged in Debian, http://pypi.python.org/pypi/simplegeneric)
1389            - apertium-tolk <unfixed> (embed)
1390            - ipython <unfixed> (embed)
1391            - virtaal <unfixed> (embed)
1392    
1393    distribute
1394            - setuptools <removed> (old-version)
1395    
1396    rails
1397            - jruby1.2 <unfixed> (embed) [./bench/rails/*]
1398            - libgettext-ruby <unfixed> (embed) [./samples/rails/*]
1399            - libopenid-ruby <unfixed> (embed) [./examples/rails_openid/*]
1400            - thin <unfixed> (embed) [./spec/rails_app/*]
1401            NOTE: this is a subdirectory of examples, which in general is a non-issue, but may
1402            NOTE: be dangerous if developers are naively basing their code off of the examples
1403            NOTE: prototype.js is among the example files
1404    
1405    lucene2 (prototype.js is among the embeds in the following)
1406            - lucene <unfixed> (old-version)
1407            - pylucene <unfixed> (embed)
1408            - libpdfbox-java <unfixed> (embed)
1409            - libfontbox-java <unfixed> (embed)
1410            - libjempbox-java <unfixed> (embed)
1411            - solr <unfixed> (embed)
1412    
1413    unicode-data
1414            - syslinux <unfixed> (embed)
1415            - camomile <unfixed> (embed)
1416            - fribidi <unfixed> (embed)
1417            - m17n-db <unfixed> (embed)
1418            - sbcl <unfixed> (embed)
1419            - heimdal <unfixed> (embed)
1420            - icu <unfixed> (embed)
1421            - icu4j <unfixed> (embed)
1422            - krb5 <unfixed> (embed)
1423            - moodle <unfixed> (embed)
1424            - openldap <unfixed> (embed)
1425            - pike7.6 <unfixed> (embed)
1426            - samba <unfixed> (embed)
1427            - samba4 <unfixed> (embed)
1428            - cmucl <unfixed> (embed)
1429            - typo3-src <unfixed> (embed)
1430            - mauve <unfixed> (embed)
1431            - texlive-bin <unfixed> (embed)
1432            - ypsilon <unfixed> (embed)
1433            - jeuclid <unfixed> (embed)
1434            - charmap.app <unfixed> (embed)
1435            - clisp <unfixed> (embed)
1436            - gnulib <unfixed> (embed)
1437            - opensrs-client <unfixed> (embed)
1438            - saxonb <unfixed> (embed)
1439            - rails <unfixed> (embed)
1440    
1441    feedparser
1442            - rawdog <unfixed> (embed; bug #383422)
1443            - miro <unfixed> (embed; bug #555351)
1444            - calibre <unfixed> (embed; bug #555352)
1445            - freevo <unfixed> (embed; bug #555353)
1446            - pida <unfixed> (embed; bug #555354)
1447            - planet-venus <unfixed> (embed; bug #555355)
1448            - plone3 <removed> (embed; bug #555356)
1449            - exaile 0.2.14+debian-1 (embed)
1450            - screenlets 0.1.2-3 (embed)
1451            NOTE: included twice
1452    
1453    agg:
1454            - matplotlib <unfixed> (embed: bug #377271)
1455            - contextfree <unfixed> (embed)
1456            NOTE: since 2.2-1 it links statically to system libagg, but still uses the embedded copy
1457            - exactimage <unfixed> (embed)
1458            - python-enable <unfixed> (embed)
1459            - mapnik 0.5.1-3 (embed)
1460            NOTE: links statically to agg, but shared library is not available (bug #377271)
1461    
1462    vtk
1463            - paraview <unfixable> (embed; bug #495426)
1464    
1465    txt2tags
1466            - rednotebook <unfixed> (embed)
1467    
1468    htmltextview (not packaged in Debian, http://www.gnome.org/~gjc/htmltextview.py)
1469            - gajim <unfixed> (embed)
1470            - emesene <unfixed> (embed)
1471            - convirt <unfixed> (embed)
1472            - pida <unfixed> (embed)
1473            - rednotebook <unfixed> (embed)
1474    
1475    horde3 (prototype.js is among the embeds in the following)
1476            - mnemo2 <unfixed> (embed)
1477            - nag2 <unfixed> (embed)
1478            - wordpress <unfixed> (embed)
1479            NOTE: Text_Diff (wp-includes/Text/Diff*)
1480    
1481    cimg
1482            - gmic <itp> (embed)
1483    
1484    mootools
1485            - gmic <itp> (embed)
1486    
1487    openldap
1488            - openldap2.3 <removed> (old-version)
1489    
1490    grub2
1491            - grub <unfixed> (old-version)
1492    
1493    gnupginterface
1494            - duplicity <unfixed> (embed)
1495    
1496    python-dateutil
1497            - awn-extras-applets <unfixed> (embed)
1498            - matplotlib <unknown> (embed)
1499    
1500    cups
1501            - cupsys <removed> (old-version)
1502    
1503    yui
1504            - bcfg2 <not-affected> (present in source but not included in any binary files)
1505            - serendipity 1.5.3-1 (embed; bug #557746)
1506            - moodle 1.8.2.dfsg-5 (embed)
1507            - jifty 0.91117-1 (embed; bug #557748)
1508            - webgui 7.7.26-1 (embed)
1509            - loggerhead 1.17-1 (embed)
1510    
1511    quake3 (vanilla source not packaged in debian)
1512            - openarena <unfixable> (fork)
1513    
1514    quake2 (vanilla source not packaged in debian)
1515            - alien-arena <unfixable> (fork)
1516            - warsow <unfixable> (fork)
1517    
1518    libtheora
1519            - iceweasel <not-affected> (uses xulrunner)
1520            - xulrunner <unfixed> (embed; bug #540959)
1521            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1522            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1523            - iceape <unfixed> (embed; bug #559276)
1524            [etch] - iceape <not-affected> (introduced in iceape 2.0)
1525            [lenny] - iceape <not-affected> (introduced in iceape 2.0)
1526    
1527    dtoa
1528            - bfilter <unfixed> (embed)
1529            - cacao <unfixed> (embed)
1530            - cdrdao <unfixed> (embed)
1531            - classpath <unfixed> (embed)
1532            - freej <unfixed> (embed)
1533            - iceape <unfixed> (embed)
1534            - iceweasel <unfixed> (embed)
1535            - jscoverage <unfixed> (embed)
1536            - kde4libs <unfixed> (embed)
1537            - kdelibs <unfixed> (embed)
1538            - kompozer <unfixed> (embed)
1539            - libv8 <unfixed> (embed)
1540            - mono <unfixed> (embed)
1541            - newlib <unfixed> (embed)
1542            - nspr <unfixed> (embed)
1543            - php5 <unfixed> (embed)
1544            - polyml <unfixed> (embed)
1545            - qt4-x11 <unfixed> (embed)
1546            - rhino <unfixed> (embed)
1547            NOTE: code translated to Java
1548            - ruby1.8 <unfixed> (embed)
1549            - ruby1.9 <unfixed> (embed)
1550            - ruby1.9.1 <unfixed> (embed)
1551            - sdd <unfixed> (embed)
1552            - sfind <unfixed> (embed)
1553            - star <unfixed> (embed)
1554            - tinymux <unfixed> (embed)
1555            - virtualbox-ose <unfixed> (embed)
1556            - webkit <unfixed> (embed)
1557            - xulrunner <unfixed> (embed)
1558    
1559    ipc (not packaged in Debian; see http://mozdev.org/pipermail/enigmail/2009-November/011678.html)
1560            - firegpg <unfixed> (embed)
1561            - enigmail <unfixed> (embed)
1562    
1563    ptmalloc (not packaged in Debian)
1564            - crystalspace <unfixed> (embed)
1565            - qt4-x11 <unfixed> (embed)
1566    
1567    svgalib
1568            - usplash <unfixed> (embed)
1569    
1570    bogl
1571            - usplash <unfixed> (embed)
1572    
1573    taglist
1574            - usplash <unfixed> (embed)
1575    
1576    portaudio
1577            - audacity <unfixed> (embed; bug #323711)
1578    
1579    nyquist
1580            - audacity <unfixed> (embed)
1581            NOTE: embeds a forked nyquist with support for a shared library
1582    
1583    vamp-plugin-sdk
1584            - audacity <unfixed> (embed)
1585    
1586    wordpress
1587            - libwordpress-xmlrpc-perl <removed> (embed) [./xmlrpc.php]
1588            - wordpress-mu <removed> (fork)
1589    
1590    php5
1591            - php4 <removed> (old-version)
1592    
1593    classpath
1594            - libgnucrypto-java <removed> (embed; bug #559788)
1595    
1596    libtool
1597            - apr <unfixed> (static; bug #489625)
1598            NOTE: ships copy of libtool in libapr1-dev; was 'embed' before 1.3.2-3
1599            - arts <unfixed> (embed)
1600            - bochs 2.4.2-1 (embed; bug #560884)
1601            - camserv <unfixed> (embed)
1602            - collectd 4.8.2-1 (embed)
1603            - courier-authlib 0.58-4 (embed)
1604            NOTE: The etch version of courier-authlib was the earliest version checked, might be fixed earlier
1605            - cvsnt 2.5.04.3236-1.2 (embed)
1606            - dico <not-affected> (Uses the system copy of ltdl)
1607            - freeradius 0.1+20010527-1 (embed)
1608            NOTE: Earliest reference I could find from the changelog is from 27 May 2001
1609            - ggobi 2.1.9~20091212-1 (embed)
1610            - glame 2.0.1-4 (embed)
1611            NOTE: The etch version of glame was the earliest version checked, might be fixed earlier
1612            - gnash 0.8.7-2 (embed)
1613            - gnu-smalltalk <unfixed> (embed; bug #566777)
1614            - google-gadgets 0.10.5-0.3 (embed)
1615            NOTE: 0.10.5-0.3 was the earliest version checked, was fixed earlier
1616            - graphicsmagick 1.3.5-6 (embed)
1617            - graphviz 2.8-3 (embed)
1618            NOTE: The etch version of graphviz was the earliest version checked, might be fixed earlier
1619            - guile-1.6 1.6.8-7 (embed)
1620            - hamlib <unfixed> (embed)
1621            - hercules 3.06-1.2 (embed)
1622            - jags 1.0.4-3 (embed; bug #560864)
1623            - kdelibs <unfixed> (embed)
1624            - libannodex <removed> (embed)
1625            - libextractor 0.5.23+dfsg-4 (embed)
1626            - libmcrypt <not-affected> (libtool source present but not included in any of the binary packages)
1627            - libtunepimp 0.5.3-7.3 (embed)
1628            - mp4h 1.3.1-4.1 (embed)
1629            - naim <removed> (embed)
1630            - parser-mysql <unfixed> (embed)
1631            - pinball 0.3.1-11 (embed)
1632            - redland <unfixed> (embed)
1633            - siproxd <unfixed> (embed)
1634            - ski <unfixed> (embed)
1635            - synfig 0.62.00-1 (embed)
1636            - unixodbc 2.2.4-5 (embed)
1637            - xmlsec1 <not-affected> (Doesn't enable dynamic loading of crypto modules)
1638            - clamav 0.95+dfsg-1 (embed)
1639            - imagemagick 6:6.2.3.1-1 (embed)
1640            - hypre 2.4.0b-5 (embed)
1641            - lam <unfixed> (embed)
1642            - openmpi <unfixable> (embed; bug #559386)
1643            - parser <unfixed> (embed)
1644            - pdsh 2.18-5 (embed; bug #560892)
1645            - sbnc 1.2-8 (embed)
1646            - sdcc <unfixed> (embed)
1647            - wml <not-affected> (The embedded ltdl isn't used, instead mp4h is used, see 559841)
1648            - proftpd-dfsg <unfixed> (embed; bug #561748)
1649            - babel 1.4.0.dfsg-5 (embed)
1650            - libprelude 0.9.14-2 (embed)
1651            - heartbeat 2.1.4-7 (embed)
1652            NOTE: From Squeeze onwards the system copy of ltdl is used, use the current version from Squeeze,
1653            NOTE: might've been fixed earlier
1654            - gcc-* <unknown> (embed)
1655    
1656    ocamlgsl
1657            - orpie 1.5.1-7.1 (embed; bug #550058)
1658    
1659    xdotool
1660            - keynav <unfixed> (embed; bug #560103)
1661    
1662    bulletphysics (not packaged; http://www.bulletphysics.org/)
1663            - supertuxkart <unfixed> (embed)
1664            - blender <unfixed> (embed)
1665    
1666    ghostscript
1667            - gs-gpl <removed> (old-version)
1668    
1669    icedove
1670            - thunderbird <removed> (old-version)
1671    
1672    sizzlejs (not packaged in Debian, http://sizzlejs.com/)
1673            - jquery <unfixed> (embed)
1674    
1675    sed
1676            - ssed <unfixed> (fork)
1677    
1678    phpatomlib (http://code.google.com/p/phpatomlib)
1679            - wordpress <unfixed> (embed)
1680    
1681    Services_JSON (http://pear.php.net/package/Services_JSON)
1682            - wordpress <unfixed> (embed)
1683    
1684    phpass (http://www.openwall.com/phpass/)
1685            - gallery2 <unfixed> (embed)
1686            - wordpress <unfixed> (embed)
1687            - typo3-src <unfixed> (modified-embed)
1688            NOTE: file refers to drupal, maybe there's a copy somewhere there
1689            NOTE: a copyright owner search didn't match anything
1690            - libauthen-passphrase-perl <unfixable> (fork)
1691            NOTE: perl implementation of phpass
1692    
1693    squirrelmail
1694            - wordpress <unfixed> (embed)
1695            NOTE: class-pop3.php
1696    
1697    ezSQL (http://www.woyano.com/jv/ezsql)
1698            - wordpress <unfixable> (fork)
1699            NOTE: wp-db.php
1700    
1701    Diff.php (Clay Loveless' version/killersoft.com)
1702            - php-versioncontrol-svn <unfixed>
1703    
1704    libm (provided by libc)
1705            - spring <unfixed> (embed)
1706            NOTE: embedded by embedded copy of streflop
1707            - aide <unfixed> (static)
1708            - busybox <unfixed> (static)
1709            - mindi-busybox <unfixed> (static)
1710            - qemu <unfixed> (static)
1711            NOTE: qemu-user-static
1712            - tuxonice-userui <unfixed> (static)
1713            - zsh <unfixed> (static)
1714            NOTE: zsh-static
1715    
1716    streflop
1717            - spring <unfixed> (embed)
1718    
1719    minizip
1720            - spring <unfixed> (embed)
1721    
1722    oscpack
1723            - spring <unfixed> (embed)
1724    
1725    hpiutil2
1726            - spring <unfixed> (embed)
1727    
1728    p7zip
1729            - spring <unfixed> (embed)
1730    
1731    pythonqt (doesn't seem to be python-qtN, unknown source)
1732            - fontmatrix <unfixed> (embed)
1733            - elmerfem <unfixed> (embed)
1734    
1735    iepngfix (not packaged in Debian; http://www.twinhelix.com/css/iepngfix/)
1736            - docvert <unfixed> (embed)
1737            - jifty <unfixed> (embed)
1738            - kdenetwork <unfixed> (embed)
1739            - mediatomb <unfixed> (embed)
1740            - plastex <unfixed> (embed)
1741            - plone3 <removed> (embed)
1742            - python-chaco <unfixed> (embed)
1743            - python-docutils <unfixed> (embed)
1744            - s5 <unfixed> (embed)
1745            - zope2.10 <unfixed> (embed)
1746            - zope2.11 <removed> (embed)
1747            - cython <not-affcted> (embed)
1748            NOTE: part of documentation, which is not installed into the binary package
1749    
1750    python-docutils
1751            - zope2.10 <unfixed> (embed)
1752            - zope2.11 <removed> (embed)
1753    
1754    tesseract
1755            - ocropus <unfixed> (static)
1756    
1757    antlr
1758            - kdevelop <unfixed> (embed)
1759    
1760    libxerces2
1761            - openjdk-6 <unfixed> (embed)
1762    
1763    kfreebsd-8
1764            - kfreebsd-7 <unfixed> (old-version)
1765            - kfreebsd-6 <removed> (old-version)
1766    
1767    ruby1.9.1
1768            - ruby1.9 <unfixed> (old-version)
1769            - ruby1.8 <unfixed> (old-version)
1770    
1771    maildrop
1772            - courier <unfixed> (embed) [./maildrop]
1773    
1774    glee
1775            - warzone2100 <unfixed> (embed)
1776    
1777    phing
1778            - symfony <unfixed> (embed)
1779    
1780    pake
1781            - symfony <unfixed> (embed)
1782    
1783    propel
1784            - symfony <unfixed> (embed)
1785    
1786    creole
1787            - symfony <unfixed> (embed)
1788    
1789    hfsutils
1790            - cdrkit <unfixed> (embed; bug #570187)
1791            NOTE: embeds hfsutils code in genisoimage
1792    
1793    cdrkit
1794            - grub2 <unfixed> (embed; bug #570156)
1795            NOTE: genisoimage imported into grub-mkisofs
1796    
1797    kdebase-workspace
1798            - kdebase <unfixed> (old-version)
1799    
1800    file
1801            - php5 <unfixable> (modified-embed)
1802            [lenny] - php5 <not-affected>
1803    
1804    cdb
1805            - php5 <unfixed> (embed)
1806    
1807    libmbfl (itp: #570708)
1808            - php5 <unfixed> (embed)
1809            NOTE: PHP is actually the current upstream, ITP is of that code
1810    
1811    libonig
1812            - php5 5.3.2-1 (embed)
1813    
1814    xmlrpc-epi
1815            - php5 <unfixed> (embed)
1816    
1817    swt-gtk
1818            - eclipse <unfixed> (embed; bug #538808)
1819    
1820    txt2html
1821            - wml 2.0.11ds2-1 (embed)
1822    
1823    ca-certificates
1824            - nss <not-affected> (certificates are in source, but not included in any of the binary packages)
1825    
1826    openexr
1827            - freeimage <unfixed> (embed)
1828    
1829    libmng
1830            - freeimage <unfixed> (embed)
1831    
1832    openjpeg
1833            - freeimage <unfixed> (embed)
1834    
1835    libjpeg6b
1836            - freeimage <unfixed> (embed)
1837    
1838    libjpeg (don't know what exact version)
1839            - dcmtk <unfixed>
1840            - gdcm <unfixed>
1841            - insighttoolkit <unfixed>
1842            - openarena <unfixed>
1843            - outguess <unfixed>
1844            - squeak-vm <unfixed> (embed)
1845            - tremulous <unfixed>
1846            - tuxonice-userui <unfixed> (static)
1847            - fpc <unfixed> (static)
1848            - lazarus <unfixed> (static)
1849            NOTE: inherited from fpc, see #472304
1850            - mseide-msegui <unfixed> (static)
1851            NOTE: inherited from fpc, see #472304
1852            - easymp3gain <unfixed> (static)
1853            NOTE: inherited from fpc, see #472304
1854            - winff <unfixed> (static)
1855            NOTE: inherited from fpc, see #472304
1856            - texlive-bin <not-affected> (included in upstream source as dependency of libgd2, but not built or included in any of the binary packages)
1857    
1858    libfile-copy-recursive-perl
1859            - r-base <unfixed> (embed; bug #577427)
1860            - r-base-core-ra <unfixed> (embed; bug #577429)
1861    
1862    delimmatch
1863            - r-base <unfixed> (embed; bug #577433)
1864            - r-base-core-ra <unfixed> (embed; bug #577434)
1865    
1866    libsmf (ITP: #572558)
1867            - denemo <unfixed> (embed)
1868            NOTE: http://lists.debian.org/debian-mentors/2010/04/msg00269.html
1869    
1870    libselinux
1871            - dpkg 1.15.6 (static)
1872    
1873    xinha (ITP: #479708)
1874            - horde3 <unfixed>
1875            - serendipity <unfixed>
1876            - openacs <unfixed>
1877            - dotlrn <unfixed>
1878    
1879    dvipng
1880            - texlive-bin <not-affected> (code present in source but not included in the binary packages)
1881    
1882    dvipdfmx
1883            - texlive-bin <unfixed> (embed)
1884            NOTE: this is intentionally part of the package now, and the separate dvipdfmx package has been removed from sid/squeeze
1885    
1886    lcdf-typetools
1887            - texlive-bin 2009-1 (embed)
1888    
1889    tex4ht
1890            - texlive-bin 2009-1 (embed)
1891    
1892    freetype
1893            - texlive-bin 2009-1 (embed)
1894    
1895    freetype2
1896            - texlive-bin 2009-1 (embed)
1897    
1898  zlib code: (separate between 1.2 and 1.1)  silgraphite
1899  dpkg          - texlive-bin <unfixed> (embed)
 rsync  
 mozilla-firefox  
 mozilla(?)  
 Linux kernels  
1900    
1901    unzip
1902            - texlive-bin 2009-1 (embed)
1903    
1904  libgadu/ekg:  jbig2dec
1905  centericq          - ghostscript 8.71~dfsg2-1 (embed)
 gaim  
 kopete (ships the code, but links dynamically in the Debian package)  
 kadu (not packaged in Debian)  
 GNU gadu (not packaged in Debian)  
   
   
 xmlrpc: (which package is the "origin" of this code?)  
 drupal  
 phpgroupware  
 egroupware  
 phpwiki  
 php4 (php-pear, IIRC this was reorganized some weeks ago?)  
 tikiwiki (not packaged in Debian)  
   
   
 shtool: (affects build-time only)  
 mysql-ocaml  
 php4  
   
   
 mozilla:  
 mozilla-firefox  
 mozilla-thunderbird  
 nvu  
   
   
 xli:  
 xloadimage  
   
   
 lesstif: (beware: two different lesstif APIs supported in one package, 1.2 discarded upstream)  
 openmotif  
 xfree86/xorg (in libxpm, still the case with x.org?  
   
   
 kerberized apps with BSD origin:  
 krb4  
 krb5  
 heimdal  
   
   
 grip: (which pkg is the origin?)  
 libcdaudio  
 grip  
 gnome-vfs (vfs2 as well?)  
   
   
 fudforum:  
 phpgroupware-fudforum  
 egroupware-fudforum  
   
   
 cvs:  
 gcvs (at least an additional script is included, check if there's more)  
   
 pcre:  
 python  
 php4 (src included, but Debian package links dynamically)  
 analog (src included, but Debian package links dynamically)  
 libgoffice-1  
 tf5 (since 5.0beta7 the Debian package links dynamically)  
   
 tiff:  
 wxpythongtk (check, which debian pkg this is in)  
 older kdegraphics/kpdf releases < 3.3 embedded a copy  
   
 uudeview:  
 libconvert-uulib-perl  
   
 sqlite: (not affected by security vulnerabilities so far)  
 amarok  
   
 uudeview:  
 libconvert-uulib-perl  
   
 util-linux/mount:  
 loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb  

Legend:
Removed from v.2068  
changed lines
  Added in v.14826

  ViewVC Help
Powered by ViewVC 1.1.5