/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 6966 by nion, Sun Oct 14 23:45:12 2007 UTC revision 8523 by nion, Sun Apr 13 11:19:23 2008 UTC
# Line 1  Line 1 
1  This file collects cases, where a source package embeds code from  Embedded code copies
2  other projects, without linking dynamically:  ====================
3    
4  xpdf code: (some use xpdf 2, some xpdf 3)  This file collects source packages that embed code from other projects.
5  gpdf (has been replaced by evince - which uses poppler - in Etch)  This is considered bad for fixing security flaws because the fix needs
6  pdftohtml (has been replaced by poppler-utils from the poppler source package, still in Etch, though)  to be applied in multiple source packages.
7  kdegraphics/kpdf (okular, the kpdf replacement in KDE 4 is using poppler, #436164)  
8  tetex-bin (links to poppler since 3.0-12)  Format:
9  cupsys (uses xpdf-utils, it's still present in the src, though)  <srcpkg> (<optional comment about srcpkg>)
10  poppler          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11  koffice/kword (upstream is working on using poppler, #436163)          NOTE: optional comments about the linkage of the embedding srcpkg
12  libextractor (uses internal pdf decoder since 0.5.12-1)  
13  pdfkit.framework (links to poppler since 0.8-4)  status: version number fixing the embedded copy, <unfixed>, <removed>,
14  ipe (only small parts, but with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp)          <itp> or <unknown> if the version number can not be determined
15            <unfixable> for unavoidable cases (e.g., forks that add real value)
16  silc-toolkit:  sort: static (linking statically against a lib)
17  silc-client (uses libsilc and libsilcclient)        embed (embedding a copy of the library into another source package)
18          fork (the package is not just embedding code but it is a fork and
19  zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)              thus might share parts of the source code)
20  dpkg        old-version (the package is an older version of essentially
21  rsync (somehow derived code base)                     the same code)
22  mozilla(?)  
23  Linux kernels  The srcpkg might be some string to identify the code if there is no
24  pvpgn (links dynamically since 1.7.8-2)  specific source package.
25  mrtg (links dynamically since 2.12.2-1)  
26  rpm  Everything up to the next line is ignored.
27    ---BEGIN
28  libbz2:  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29  dpkg (statically linked)          NOTE: Fixed packages link to poppler library unless otherwise noted
30            - gpdf <removed>
31  libgadu/ekg:          [sarge] - gpdf <unfixed>
32  centericq          NOTE: has been replaced by evince in etch
33  gaim          - pdftohtml <unknown>
34  kopete (ships the code, but links dynamically in the Debian package)          [sarge] - pdftohtml <unfixed>
35  kadu (not packaged in Debian)          [etch] - pdftohtml <unfixed>
36  GNU gadu (not yet packaged in Debian)          NOTE: has been replaced by poppler-utils
37            - kdegraphics <unfixed> (embed; bug #436164)
38  xmlrpc: (which package is the "origin" of this code?)          NOTE: the kpdf replacement in KDE 4 is using poppler
39  drupal          - tetex-bin 3.0-12 (embed)
40  phpgroupware          - texlive-bin 2007-1 (embed)
41  egroupware          NOTE: links to poppler
42  phpwiki          - koffice <unfixed> (embed; bug #436163)
43  php4 (php-pear, IIRC this was reorganized some weeks ago?)          - libextractor 0.5.12-1 (embed)
44  tikiwiki          NOTE: libextractor is using its own pdf decoder now
45            - libextractor 0.5.12-1 (embed)
46  shtool: (affects build-time only)          - pdfkit.framework 0.8-4 (embed)
47  mysql-ocaml          - ipe <unfixed> (embed)
48  php4          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
49            - ruby-gnome2 <unknown> (embed)
50  mozilla:          NOTE: copy only present in source but links to poppler
51  mozilla-firefox  
52  mozilla-thunderbird  ppmd
53  firefox (to be removed)          - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
54  thunderbird (to be removed)  
55  iceweasel  peercast
56  iceape          - gnome-peercast <unfixed> (embed)
57  icedove          NOTE: gnome-peercast may better be removed, see #466539
58  xulrunner  
59  nvu (no longer in Debian)  silc-toolkit
60            - silc-client 1.1~beta6-1 (embed)
61  xli:  
62  xloadimage  dietlibc
63            - ccontrol 0.9.1+20071204-1 (static)
64  lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)  
65  openmotif  libiax
66  xfree86/xorg (in libxpm)          - iaxmodem <unfixed> (embed)
67    
68  kerberized apps with BSD origin:  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
69  krb4          - dpkg <unfixed> (embed)
70  krb5          NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
71  heimdal          - rsync <unfixed> (embed)
72            NOTE: somehow derived code base
73  grip: (which pkg is the origin?)          - mono <unfixed> (embed)
74  libcdaudio          TODO: check mozilla
75  grip          - Linux kernels <unfixed> (embed)
76  gnome-vfs (vfs2 as well?)          - pvpgn 1.7.8-2 (embed)
77            - mrtg 2.12.2-1 (embed)
78  fudforum:          - rpm <unknown> (embed)
79  phpgroupware-fudforum          NOTE: pinged anibal since when rpm was fixed
80  egroupware-fudforum (removed from egroupware after sarge)  
81    libbz2
82  cvs:          - dpkg <unfixed> (static)
83  gcvs (at least an additional script is included, check if there's more)  
84    ekg
85  pcre:          - centericq <unfixed> (embed)
86  all pythons          - gaim <unfixed> (embed)
87  php4 (src included, but Debian package links dynamically)          - pigdin <unfixed> (embed)(links dynamically against libgadu)
88  analog (src included, but Debian package links dynamically)          - kopete 4:3.3.2-5 (embed)
89  libgoffice-1          - kadu <unfixed> (embed)
90  vfu          - gadu <unfixed> (embed)
91  tf5 (since 5.0beta7 the Debian package links dynamically)          NOTE: g/kadu not packaged in Debian yet
92    
93  tiff:  xmlrpc (which package is the "origin" of this code?)
94  wxpythongtk (check, which debian pkg this is in)          - drupal <unfixed> (embed)
95  older kdegraphics/kpdf releases < 3.3 embedded a copy          - phpgroupware <unfixed> (embed)
96            - egroupware <unfixed> (embed)
97  uudeview:          - phpwiki (embed)
98  libconvert-uulib-perl          - php4 <unfixed> (embed)
99            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
100  sqlite: (not affected by security vulnerabilities so far)  
101  amarok  shtool (affects build-time only)
102            - mysql-ocaml <unfixed> (embed)
103  util-linux/mount:          - php4 <unfixed> (embed)
104  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb  
105    mozilla source code
106  webmin:          - mozilla-firefox <unfixed> (embed)
107  usermin (only in sarge)          - mozilla-thunderbird
108            - firefox <removed>
109  fckeditor:          [etch] - firefox <unfixed> (embed)
110  knowledgeroot          - thunderbird <removed>
111            [etch] - thunderbird <unfixed> (embed)
112  sylpheed:          - iceweasel <unfixed> (embed)
113  sylpheed-claws          - iceape <unfixed> (embed)
114            - icedove <unfixed> (embed)
115  phpsysinfo:          - xulrunner <unfixed> (embed)
116  egroupware          - nvu <removed> (embed)
117  phpgroupware  
118    xli
119            - xloadimage <unfixed> (embed)
120    
121    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
122            - openmotif <unfixed> (embed)
123            - xfree86/xorg <unfixed> (embed)
124            NOTE: in libxpm
125    
126    kerberized apps with BSD origin
127            - krb4 <unfixed> (embed)
128            - krb5 <unfixed> (embed)
129            - heimdal <unfixed> (embed)
130    
131    grip (which pkg is the origin?)
132            - libcdaudio
133            - grip
134            - gnome-vfs
135            TODO: check vfs2 as well
136    
137    fudforum
138            - phpgroupware-fudforum <unfixed> (embed)
139            - egroupware-fudforum <removed>
140            [sarge] - egroupware-fudforum <unfixed> (embed)
141    
142    cvs
143            - gcvs <unfixed> (embed)
144            NOTE: see cvsunix/src in tarball
145    
146    pcre
147            - python* <unfixed> (embed)
148            - php4 <unknown> (embed)
149            - analog 2:5.23-0woody1 (embed)
150            - libgoffice-1 <unfixed> (embed)
151            - vfu 4.06-4.1 (embed; bug #450754)
152            - tf5 5.0beta7-1 (embed)
153            - monotone <unfixed> (embed)
154            NOTE: this only affects versions >= 0.37
155            - glib <unfixed> (embed)
156            NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic
157            - apache2 2.0.53-4 (embed)
158            - exim4 4.10-0.srh20.12 (embed)
159            - yacas <unfixed> (embed)
160            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
161            - gtamsanalyzer.app 0.42-5 (embed)
162            - tin <unknown> (embed)
163    
164    tiff
165            - wxpythongtk <unfixed> (embed)
166            TODO: check, which debian pkg this is in
167    
168    uudeview
169            - libconvert-uulib-perl <unfixed> (embed)
170    
171    sqlite (not affected by security vulnerabilities so far)
172            - amarok <unfixed> (embed)
173            - monotone <unfixed> (embed)
174            - iceweasel <unfixed> (embed)
175    
176    util-linux/mount
177            - loop-aes-utils <unfixed> (embed)
178            NOTE: contains code from util-linux' mount in the mount-aes-udeb
179    
180    webmin
181            - usermin <unknown> (embed)
182            [sarge] - usermin <unfixed> (embed)
183    
184    sylpheed
185            - sylpheed-claws <unfixed> (fork)
186    
187    phpsysinfo
188            - egroupware <unfixed> (embed)
189            - phpgroupware <unfixed> (embed)
190    
191    phpldapadmin
192            [sarge] - egroupware <unfixed> (embed)
193            NOTE: removed from egroupware after sarge
194    
195    chmlib
196            - kchmviewer <unknown> (embed)
197    
198    libavcodec/libavformat (source: ffmpeg)
199            - mplayer <unfixed> (embed; bug #395252)
200            - xvidcap <unfixed> (embed)
201            - kino <unfixed> (static)
202            - vlc <unfixed> (static)
203            - smilutils <unfixed> (static)
204            - motion <unfixed> (static)
205            - gst-ffmpeg <unfixed> (embed)
206            - gstreamer0.10-ffmpeg <unfixed> (embed)
207            - xmovie <unfixed>
208            TODO: gimp-gap (potentially using ffmpeg code as well)
209    
210    mad MPEG decoding lib
211            - mad <unfixed> (embed)
212            - xine-lib <unfixed> (embed)
213    
 phpldapadmin:  
 egroupware (removed from egroupware after sarge)  
   
 chmlib:  
 kchmviewer (not packaged in Debian)  
   
 libavcodec/libavformat:  
 ffmpeg  
 xine-lib  
 xvidcap  
 kino (links statically, does not include code)  
 vlc (links statically, does not include code)  
 smilutils (links statically, does not include code)  
 motion (links statically, does not include code)  
 gst-ffmpeg  
 gstreamer0.10-ffmpeg  
 xmovie  
   
 mad MPEG decoding lib:  
 mad  
 xine-lib  
   
 libdts:  
214  libdts  libdts
215  xine-lib          - xine-lib <unfixed> (embed)
216    
 flac:  
217  flac  flac
218  xine-lib          - xine-lib <unfixed> (embed)
219    
220  liba52:  liba52
221  a52dec          - a52dec <unfixed> (embed)
222  xine-lib          - xine-lib <unfixed> (embed)
223    
224  libmpeg2:  libmpeg2
225  mpeg2dec          - mpeg2dec <unfixed> (embed)
226  xine-lib          - xine-lib <unfixed> (embed)
227    
228  curl:  curl
229  wget (code for NTLM authentication)          - wget <unfixed> (embed)
230            NOTE: code for NTLM authentication
231    
232  TODO evaluate:  uw-imap
233  gimp-gap (potentially using ffmpeg code as well)          - pine <unfixed> (embed)
234            - alpine <unfixed> (embed)
235    
236  uw-imap:  imagemagick
237  pine          - graphicsmagick <unfixed> (fork)
238    
239  imagemagick:  halibut
240  graphicsmagick          - nsis <unfixed> (embed)
241    
242  halibut:  libghttp
243  nsis          - hotway <unfixed> (embed)
244    
245  libghttp:  libsndfile
246  hotway          - ardour <unfixed> (embed)
247    
248  libsndfile:  glibmm2.4
249  ardour          - ardour <unfixed> (embed)
250    
251  glibmm2.4:  libgnomecanvasmm2.6
252  ardour          - ardour <unfixed> (embed)
253    
254  libgnomecanvasmm2.6:  libsigc++-2.0
255  ardour          - ardour <unfixed> (embed)
256    
257  libsigc++-2.0:  soundtouch
258  ardour          - ardour <unfixed> (embed)
259    
260  soundtouch:  libmms
261  ardour          - xine-lib <unfixed> (embed)
262            - mimms <unfixed> (embed)
263    
264  libmms:  fckeditor
265  xine-lib          - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
266  mimms          - moin <unfixed> (embed; bug #452599)
267            - karrigell <unfixed> (embed; bug #452598)
268  FCKeditor:          - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
 knowledgeroot  
   
 Moodle contains lots of things:  
 AdoDB  
 AdoDB-XML Schema  
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
 TinyMCE  
 bennu  
269    
270  TinyMCE:  ipatlas (not packaged in Debian)
271  wordpress          - moodle <unfixed> (embed)
 moodle  
 knowledgeroot  
 joomla (ITP)  
272    
273  scintilla:  libphp-phpmailer
274  scite          - moodle <unfixed> (embed)
 qscintilla  
 geany  
275    
276  libphp-adodb:  htmlArea (not packaged in Debian)
277  gallery2          - moodle <unfixed> (embed)
 phppgadmin  
 egroupware  
 phpwiki  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
278    
279  gzip:  giflib:
280  linux-kernel (lib/inflate.c)          - wine <unfixed> (embed; bug #466181)
 klibc (based on linux-kernel gzip code)  
 busybox  
281    
282  ffmpeg:  bennu (not packaged in Debian)
283  mplayer (#395252)          - moodle <unfixed> (embed)
284    
285  neon:  smarty:
286  cadaver (all, but being worked on: #188381)          - moodle <unfixed> (embed; bug #471158)
287  gnome-vfs2 (#395874)          - gallery2 <unfixed> (embed; bug #471160)
288  litmus (#395875)          - mahara 0.9.2-2 (embed; bug #471201)
289  screem (sarge only)          - gosa 2.4beta1-1 (embed; bug #471200)
 sitecopy (#395876)  
 tla (etch/sid only: #395877)  
290    
291  libmodplug:  TinyMCE
292  gst-plugins-bad0.10          - wordpress <unfixed> (embed)
293            - moodle <unfixed> (embed)
294  libvncserver:          - knowledgeroot <unfixed> (embed)
295  vino          - joomla <itp> (bug #326398)
296    
297  putty:  scintilla
298  filezilla          - scite <unfixed> (embed)
299            - qscintilla <unfixed> (embed)
300  tinyxml (not packaged in Debian):          - qscintilla2 <unfixed> (embed)
301  filezilla          - geany <unfixed> (embed)
302    
303  gv:  libphp-adodb
304  evince (ps/ tree from gv 3.5.8)          - moodle <unfixed> (embed)
305  evince-gtk (not packaged in Debian)          NOTE: also AdoDB-XML Schema
306            - gallery2 <unfixed> (embed)
307  libXbae:          - phppgadmin <unfixed> (embed)
308  libpawlib2-lesstif package (from Cernlib)          - egroupware <unfixed> (embed)
309            - phpwiki <unfixed> (embed)
310  libXaw:          - ipplan <unfixed> (embed)
311  libpawlib2-lesstif package (from Cernlib)          - typo3 <unfixed> (embed)
312            - moodle <unfixed> (embed)
313  (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)          - cacti <unknown> (embed)
314            [sarge] - cacti <unfixed> (embed)
315  libgd2:          NOTE: dependency exists, but internal version is used
316  graphviz (lib/gd seems to be 2.0.33)  
317    gzip
318  rar:          - linux-kernel <unfixed> (embed)
319  unrar-nonfree          NOTE: lib/inflate.c
320            - klibc <unfixed> (embed)
321  unrar-free: (maybe this code is derived from the original rar, too?)          NOTE: based on linux-kernel gzip code
322  clamav (seems to be disabled in default config)          - busybox <unfixed> (embed)
323    
324  mplayer (DirectMedia Object loader):  neon
325  xine-lib (src/libw32dll/)          - cadaver <unfixed> (embed; bug #188381)
326  vlc (modules/codec/dmo/)          - gnome-vfs2 <unfixed> (embed; bug #395874)
327            - litmus <unfixed> (embed; #395875)
328            [sarge] - screem <unfixed> (embed)
329            - sitecopy <unfixed> (embed; bug #395876)
330            [etch] - tla <unfixed> (embed; bug #395877)
331            [sarge] - tla <unfixed> (embed; bug #395877)
332    
333    libmodplug
334            - gst-plugins-bad0.10 <unfixed> (embed)
335    
336    libvncserver
337            - vino <unfixed> (embed)
338    
339    putty
340            - filezilla <unfixed> (embed)
341    
342    tinyxml (not packaged in Debian)
343            - filezilla <unfixed>
344    
345    gv
346            - evince <unfixed> (embed)
347            NOTE: ps/ tree from gv 3.5.8
348            - evince-gtk <unfixed> (embed)
349            NOTE: not packaged in Debian
350    
351    libXbae
352            [etch] - libpawlib2-lesstif <unfixed> (embed)
353            NOTE: from Cernlib
354    
355    libXaw
356            [etch] - libpawlib2-lesstif
357            NOTE: from Cernlib
358            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
359    
360    libgd2
361            - graphviz <unfixed> (embed)
362            NOTE: lib/gd seems to be 2.0.33
363            - wml <unfixed> (embed)
364            NOTE: derived from gd 1.6.3
365    
366    rar
367            - unrar-nonfree <unfixed> (embed)
368    
369    unrar-free (maybe this code is derived from the original rar, too?)
370            - clamav <unfixed> (embed)
371            NOTE: seems to be disabled in default config
372    
373    mplayer (DirectMedia Object loader)
374            - xine-lib <unfixed> (embed)
375            NOTE: src/libw32dll/
376            - vlc <unfixed> (embed)
377            NOTE: modules/codec/dmo/
378    
379    libwpd (WordPerfect converter)
380            - openoffice.org <unfixed> (embed)
381    
382    fsplib (http://sourceforge.net/projects/fsp/)
383            - gftp <unfixed> (embed)
384            NOTE: lib/fsplib version 0.3
385    
386    librpcsecgss
387            - krb5 <unfixed> (embed)
388    
389    jasper
390            - ghostscript <unfixed> (embed)
391            - gs-gpl <unfixed> (embed)
392    
393    libidn
394            - monotone <unfixed> (embed)
395    
396    liblua
397            - monotone <unfixed> (embed)
398    
399    libbotan
400            - montone <unfixed> (embed)
401    
402    NetXX
403            - monotone <unfixed> (embed)
404    
405    libgc
406            - mono <unfixed> (embed)
407    
408    lzma
409            - p7zip <unfixed> (embed)
410    
411    lzo
412            - grub2 <unfixed> (embed)
413    
414    yassl
415            - mysql-dfsg-5.0 <unfixed> (embed)
416    
417    pax code
418            - tar <unfixed> (embed)
419            - cpio <unfixed> (embed)
420    
421    t1lib
422            - tetex-bin 2.0.2-1 (embed)
423            - texlive-bin <unknown> (embed)
424    
425    guichan
426            - boswars <unfixed> (embed)
427            NOTE: maintainer notified us, working on it
428    
429    tolua
430            - boswars <unfixed> (embed)
431            NOTE: maintainer notified us, working on it
432    
433    asio-dev
434            - luxrender <unfixed> (embed)
435            NOTE: maintainer notified us, working on it
436            NOTE: may be merged with boost "soon"
437    
438  libwpd (WordPerfect converter):  xine-lib
439  openoffice.org          - vlc <unfixed> (embed)
440            NOTE: only parts included in modules/access/rtsp
441    
442  fsplib (http://sourceforge.net/projects/fsp/):  netpbm
443  gftp (lib/fsplib version 0.3)          - tcl8.3 <unfixed> (embed)
444            - tcl8.4 <unfixed> (embed)
445            - tcl8.5 <unfixed> (embed)
446            NOTE: generic/tkImgGIF.c
447    
448    tk8.5
449            - tk8.0 <removed> (old-version)
450            - tk8.3 <unfixed> (old-version)
451            - tk8.4 <unfixed> (old-version)
452            - perl-tk <unfixable> (fork)
453    
454    samba
455            - mc <unfixed> (embed)
456            NOTE: maintainer is aware of this, currently searching a solution
457    
458    plib1.8.4c2
459            - boson <unfixed> (fork)
460            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
461    
462    fribidi
463            - quesoglc <unfixed> (embed)
464    
465    glew
466            - quesoglc <unfixed> (embed)
467    
468    minorGems
469            - transcend <unfixed> (embed)
470            - cultivation <unfixed> (embed)
471    
472    libarchive
473            - tar <unfixed> (embed)
474            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
475            - cpio <unfixed> (embed)
476            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
477    
478  librpcsecgss:  webkit
479  krb5          - qt4-x11 <unfixed> (embed)

Legend:
Removed from v.6966  
changed lines
  Added in v.8523

  ViewVC Help
Powered by ViewVC 1.1.5