/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 7136 by nion, Mon Oct 29 08:12:38 2007 UTC revision 7927 by nion, Tue Jan 15 12:18:04 2008 UTC
# Line 1  Line 1 
1    Embedded code copies
2    ====================
3    
4  This file collects cases, where a source package embeds code from  This file collects cases, where a source package embeds code from
5  other projects, without linking dynamically:  other projects which is considered bad for fixing security flaws
6    because the fix needs to be applied in multiple source packages.
7    
8  xpdf code: (some use xpdf 2, some xpdf 3)  Format:
9  gpdf (has been replaced by evince - which uses poppler - in Etch)  <srcpkg> (<optional comment about srcpkg>)
10  pdftohtml (has been replaced by poppler-utils from the poppler source package, still in Etch, though)          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11  kdegraphics/kpdf (okular, the kpdf replacement in KDE 4 is using poppler, #436164)          NOTE: optional comments about the linkage of the embedding srcpkg
12  tetex-bin (links to poppler since 3.0-12)  
13  cupsys (uses xpdf-utils, it's still present in the src, though)  status: version number fixing the embedded copy, <unfixed>, <removed>, <itp> or <unknown> if the version number can not be determined
14  poppler  sort: static (linking statically against a lib)
15  koffice/kword (upstream is working on using poppler, #436163)        embed (embedding a copy of the library into another source package)
16  libextractor (uses internal pdf decoder since 0.5.12-1)        fork (the package is not just embedding code but it is a fork and thus might share parts of the source code)
17  pdfkit.framework (links to poppler since 0.8-4)  
18  ipe (only small parts, but with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp)  The srcpkg might be some string to identify the code if there is no specific source package.
19    
20  silc-toolkit:  Everything up to the next line is ignored
21  silc-client (uses libsilc and libsilcclient)  ---BEGIN
22    xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
23  dietlibc:          NOTE: Fixed packages link to poppler library unless otherwise noted
24  ccontrol (links statically)          - gpdf <removed>
25            [sarge] - gpdf <unfixed>
26  libiax:          NOTE: has been replaced by evince in etch
27  iaxmodem          - pdftohtml <unknown>
28            [sarge] - pdftohtml <unfixed>
29  zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)          [etch] - pdftohtml <unfixed>
30  dpkg          NOTE: has been replaced by poppler-utils
31  rsync (somehow derived code base)          - kdegraphics <unfixed> (embed; bug #436164)
32  mono          NOTE: the kpdf replacement in KDE 4 is using poppler
33  mozilla(?)          - tetex-bin 3.0-12 (embed)
34  Linux kernels          - texlive-bin 2007-1 (embed)
35  pvpgn (links dynamically since 1.7.8-2)          NOTE: links to poppler
36  mrtg (links dynamically since 2.12.2-1)          - koffice <unfixed> (embed; bug #436163)
37  rpm          - libextractor 0.5.12-1 (embed)
38            NOTE: libextractor is using its own pdf decoder now
39  libbz2:          - libextractor 0.5.12-1 (embed)
40  dpkg (statically linked)          - pdfkit.framework 0.8-4 (embed)
41            - ipe <unfixed> (embed)
42  libgadu/ekg:          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
43  centericq          - ruby-gnome2 <unknown> (embed)
44  gaim          NOTE: copy only present in source but links to poppler
45  kopete (ships the code, but links dynamically in the Debian package)  
46  kadu (not packaged in Debian)  ppmd
47  GNU gadu (not yet packaged in Debian)          - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
48    
49  xmlrpc: (which package is the "origin" of this code?)  silc-toolkit
50  drupal          - silc-client 1.1~beta6-1 (embed)
51  phpgroupware  
52  egroupware  dietlibc
53  phpwiki          - ccontrol 0.9.1+20071204-1 (static)
54  php4 (php-pear, IIRC this was reorganized some weeks ago?)  
55  tikiwiki  libiax
56            - iaxmodem <unfixed> (embed)
57  shtool: (affects build-time only)  
58  mysql-ocaml  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
59  php4          - dpkg <unfixed> (embed)
60            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
61  mozilla:          - rsync <unfixed> (embed)
62  mozilla-firefox          NOTE: somehow derived code base
63  mozilla-thunderbird          - mono <unfixed> (embed)
64  firefox (to be removed)          TODO: check mozilla
65  thunderbird (to be removed)          - Linux kernels <unfixed> (embed)
66  iceweasel          - pvpgn 1.7.8-2 (embed)
67  iceape          - mrtg 2.12.2-1 (embed)
68  icedove          - rpm <unknown> (embed)
69  xulrunner          NOTE: pinged anibal since when rpm was fixed
70  nvu (no longer in Debian)  
71    libbz2
72  xli:          - dpkg <unfixed> (static)
73  xloadimage  
74    ekg
75  lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)          - centericq <unfixed> (embed)
76  openmotif          - gaim <unfixed> (embed)
77  xfree86/xorg (in libxpm)          - pigdin <unfixed> (embed)(links dynamically against libgadu)
78            - kopete 4:3.3.2-5 (embed)
79  kerberized apps with BSD origin:          - kadu <unfixed> (embed)
80  krb4          - gadu <unfixed> (embed)
81  krb5          NOTE: g/kadu not packaged in Debian yet
82  heimdal  
83    xmlrpc (which package is the "origin" of this code?)
84  grip: (which pkg is the origin?)          - drupal <unfixed> (embed)
85  libcdaudio          - phpgroupware <unfixed> (embed)
86  grip          - egroupware <unfixed> (embed)
87  gnome-vfs (vfs2 as well?)          - phpwiki (embed)
88            - php4 <unfixed> (embed)
89  fudforum:          TODO: check, php-pear, IIRC this was reorganized some weeks ago?
90  phpgroupware-fudforum  
91  egroupware-fudforum (removed from egroupware after sarge)  shtool (affects build-time only)
92            - mysql-ocaml <unfixed> (embed)
93  cvs:          - php4 <unfixed> (embed)
94  gcvs (at least an additional script is included, check if there's more)  
95    mozilla source code
96  pcre:          - mozilla-firefox <unfixed> (embed)
97  all pythons          - mozilla-thunderbird
98  php4 (src included, but Debian package links dynamically)          - firefox <removed>
99  analog (src included, but Debian package links dynamically)          [etch] - firefox <unfixed> (embed)
100  libgoffice-1          - thunderbird <removed>
101  vfu          [etch] - thunderbird <unfixed> (embed)
102  tf5 (since 5.0beta7 the Debian package links dynamically)          - iceweasel <unfixed> (embed)
103  monotone (including this starting from 0.37)          - iceape <unfixed> (embed)
104            - icedove <unfixed> (embed)
105  tiff:          - xulrunner <unfixed> (embed)
106  wxpythongtk (check, which debian pkg this is in)          - nvu <removed> (embed)
107  older kdegraphics/kpdf releases < 3.3 embedded a copy  
108    xli
109  uudeview:          - xloadimage <unfixed> (embed)
110  libconvert-uulib-perl  
111    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
112  sqlite: (not affected by security vulnerabilities so far)          - openmotif <unfixed> (embed)
113  amarok          - xfree86/xorg <unfixed> (embed)
114  monotone          NOTE: in libxpm
115    
116  util-linux/mount:  kerberized apps with BSD origin
117  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb          - krb4 <unfixed> (embed)
118            - krb5 <unfixed> (embed)
119  webmin:          - heimdal <unfixed> (embed)
120  usermin (only in sarge)  
121    grip (which pkg is the origin?)
122  sylpheed:          - libcdaudio
123  sylpheed-claws          - grip
124            - gnome-vfs
125  phpsysinfo:          TODO: check vfs2 as well
126  egroupware  
127  phpgroupware  fudforum
128            - phpgroupware-fudforum <unfixed> (embed)
129  phpldapadmin:          - egroupware-fudforum <removed>
130  egroupware (removed from egroupware after sarge)          [sarge] - egroupware-fudforum <unfixed> (embed)
131    
132  chmlib:  cvs
133  kchmviewer (not packaged in Debian)          - gcvs <unfixed> (embed)
134            NOTE: see cvsunix/src in tarball
135  libavcodec/libavformat:  
136  ffmpeg  pcre
137  xine-lib          - python* <unfixed> (embed)
138  xvidcap          - php4 <unknown> (embed)
139  kino (links statically, does not include code)          - analog 2:5.23-0woody1 (embed)
140  vlc (links statically, does not include code)          - libgoffice-1 <unfixed> (embed)
141  smilutils (links statically, does not include code)          - vfu 4.06-4.1 (embed; bug #450754)
142  motion (links statically, does not include code)          - tf5 5.0beta7-1 (embed)
143  gst-ffmpeg          - monotone <unfixed> (embed)
144  gstreamer0.10-ffmpeg          NOTE: this only affects versions >= 0.37
145  xmovie          - glib <unfixed> (embed)
146            NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic
147  mad MPEG decoding lib:          - apache2 2.0.53-4 (embed)
148  mad          - exim4 4.10-0.srh20.12 (embed)
149  xine-lib          - yacas <unfixed> (embed)
150            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
151            - gtamsanalyzer.app 0.42-5 (embed)
152    
153    tiff
154            - wxpythongtk <unfixed> (embed)
155            TODO: check, which debian pkg this is in
156    
157    uudeview
158            - libconvert-uulib-perl <unfixed> (embed)
159    
160    sqlite (not affected by security vulnerabilities so far)
161            - amarok <unfixed> (embed)
162            - monotone <unfixed> (embed)
163            - iceweasel <unfixed> (embed)
164    
165    util-linux/mount
166            - loop-aes-utils <unfixed> (embed)
167            NOTE: contains code from util-linux' mount in the mount-aes-udeb
168    
169    webmin
170            - usermin <unknown> (embed)
171            [sarge] - usermin <unfixed> (embed)
172    
173    sylpheed
174            - sylpheed-claws <unfixed> (fork)
175    
176    phpsysinfo
177            - egroupware <unfixed> (embed)
178            - phpgroupware <unfixed> (embed)
179    
180    phpldapadmin
181            [sarge] - egroupware <unfixed> (embed)
182            NOTE: removed from egroupware after sarge
183    
184    chmlib
185            - kchmviewer <unknown> (embed)
186    
187    libavcodec/libavformat (source: ffmpeg)
188            - mplayer <unfixed> (embed; bug #395252)
189            - xvidcap <unfixed> (embed)
190            - kino <unfixed> (static)
191            - vlc <unfixed> (static)
192            - smilutils <unfixed> (static)
193            - motion <unfixed> (static)
194            - gst-ffmpeg <unfixed> (embed)
195            - gstreamer0.10-ffmpeg <unfixed> (embed)
196            - xmovie <unfixed>
197            TODO: gimp-gap (potentially using ffmpeg code as well)
198    
199    mad MPEG decoding lib
200            - mad <unfixed> (embed)
201            - xine-lib <unfixed> (embed)
202    
 libdts:  
203  libdts  libdts
204  xine-lib          - xine-lib <unfixed> (embed)
205    
 flac:  
206  flac  flac
207  xine-lib          - xine-lib <unfixed> (embed)
   
 liba52:  
 a52dec  
 xine-lib  
   
 libmpeg2:  
 mpeg2dec  
 xine-lib  
   
 curl:  
 wget (code for NTLM authentication)  
   
 TODO evaluate:  
 gimp-gap (potentially using ffmpeg code as well)  
   
 uw-imap:  
 pine  
 alpine  
   
 imagemagick:  
 graphicsmagick  
   
 halibut:  
 nsis  
   
 libghttp:  
 hotway  
   
 libsndfile:  
 ardour  
   
 glibmm2.4:  
 ardour  
   
 libgnomecanvasmm2.6:  
 ardour  
   
 libsigc++-2.0:  
 ardour  
208    
209  soundtouch:  liba52
210  ardour          - a52dec <unfixed> (embed)
211            - xine-lib <unfixed> (embed)
212    
213  libmms:  libmpeg2
214  xine-lib          - mpeg2dec <unfixed> (embed)
215  mimms          - xine-lib <unfixed> (embed)
216    
217  FCKeditor:  curl
218  knowledgeroot          - wget <unfixed> (embed)
219  moin          NOTE: code for NTLM authentication
 karrigell  
 gforge-plugins-extra  
220    
221  Moodle contains lots of things:  uw-imap
222  AdoDB          - pine <unfixed> (embed)
223  AdoDB-XML Schema          - alpine <unfixed> (embed)
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
 TinyMCE  
 bennu  
   
 TinyMCE:  
 wordpress  
 moodle  
 knowledgeroot  
 joomla (ITP)  
   
 scintilla:  
 scite  
 qscintilla  
 qscintilla2  
 geany  
   
 libphp-adodb:  
 gallery2  
 phppgadmin  
 egroupware  
 phpwiki  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
   
 gzip:  
 linux-kernel (lib/inflate.c)  
 klibc (based on linux-kernel gzip code)  
 busybox  
   
 ffmpeg:  
 mplayer (#395252)  
   
 neon:  
 cadaver (all, but being worked on: #188381)  
 gnome-vfs2 (#395874)  
 litmus (#395875)  
 screem (sarge only)  
 sitecopy (#395876)  
 tla (etch/sid only: #395877)  
224    
225  libmodplug:  imagemagick
226  gst-plugins-bad0.10          - graphicsmagick <unfixed> (fork)
227    
228  libvncserver:  halibut
229  vino          - nsis <unfixed> (embed)
230    
231  putty:  libghttp
232  filezilla          - hotway <unfixed> (embed)
233    
234  tinyxml (not packaged in Debian):  libsndfile
235  filezilla          - ardour <unfixed> (embed)
236    
237  gv:  glibmm2.4
238  evince (ps/ tree from gv 3.5.8)          - ardour <unfixed> (embed)
 evince-gtk (not packaged in Debian)  
239    
240  libXbae:  libgnomecanvasmm2.6
241  libpawlib2-lesstif package (from Cernlib)          - ardour <unfixed> (embed)
242    
243  libXaw:  libsigc++-2.0
244  libpawlib2-lesstif package (from Cernlib)          - ardour <unfixed> (embed)
245    
246  (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  soundtouch
247            - ardour <unfixed> (embed)
248    
249  libgd2:  libmms
250  graphviz (lib/gd seems to be 2.0.33)          - xine-lib <unfixed> (embed)
251            - mimms <unfixed> (embed)
252    
253  rar:  fckeditor
254  unrar-nonfree          - knowledgeroot <unfixed> (embed)
255            - moin <unfixed> (embed; bug #452599)
256            - karrigell <unfixed> (embed; bug #452598)
257            - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
258    
259  unrar-free: (maybe this code is derived from the original rar, too?)  ipatlas (not packaged in Debian)
260  clamav (seems to be disabled in default config)          - moodle <unfixed> (embed)
261    
262  mplayer (DirectMedia Object loader):  libphp-phpmailer
263  xine-lib (src/libw32dll/)          - moodle <unfixed> (embed)
 vlc (modules/codec/dmo/)  
264    
265  libwpd (WordPerfect converter):  htmlArea (not packaged in Debian)
266  openoffice.org          - moodle <unfixed> (embed)
267    
268  fsplib (http://sourceforge.net/projects/fsp/):  bennu (not packaged in Debian)
269  gftp (lib/fsplib version 0.3)          - moodle <unfixed> (embed)
270    
271  librpcsecgss:  smarty:
272  krb5          - moodle <unfixed> (embed)
273    
274  jasper:  TinyMCE
275  ghostscript          - wordpress <unfixed> (embed)
276  gs-gpl          - moodle <unfixed> (embed)
277            - knowledgeroot <unfixed> (embed)
278  libidn:          - joomla <itp> (bug #326398)
279  monotone  
280    scintilla
281  liblua:          - scite <unfixed> (embed)
282  monotone          - qscintilla <unfixed> (embed)
283            - qscintilla2 <unfixed> (embed)
284  libbotan:          - geany <unfixed> (embed)
285  montone  
286    libphp-adodb
287  NetXX:          - moodle <unfixed> (embed)
288  monotone          NOTE: also AdoDB-XML Schema
289            - gallery2 <unfixed> (embed)
290  libgc:          - phppgadmin <unfixed> (embed)
291  mono          - egroupware <unfixed> (embed)
292            - phpwiki <unfixed> (embed)
293            - ipplan <unfixed> (embed)
294            - typo3 <unfixed> (embed)
295            - moodle <unfixed> (embed)
296            - cacti <unknown> (embed)
297            [sarge] - cacti <unfixed> (embed)
298            NOTE: dependency exists, but internal version is used
299    
300    gzip
301            - linux-kernel <unfixed> (embed)
302            NOTE: lib/inflate.c
303            - klibc <unfixed> (embed)
304            NOTE: based on linux-kernel gzip code
305            - busybox <unfixed> (embed)
306    
307    neon
308            - cadaver <unfixed> (embed; bug #188381)
309            - gnome-vfs2 <unfixed> (embed; bug #395874)
310            - litmus <unfixed> (embed; #395875)
311            [sarge] - screem <unfixed> (embed)
312            - sitecopy <unfixed> (embed; bug #395876)
313            [etch] - tla <unfixed> (embed; bug #395877)
314            [sarge] - tla <unfixed> (embed; bug #395877)
315    
316    libmodplug
317            - gst-plugins-bad0.10 <unfixed> (embed)
318    
319    libvncserver
320            - vino <unfixed> (embed)
321    
322    putty
323            - filezilla <unfixed> (embed)
324    
325    tinyxml (not packaged in Debian)
326            - filezilla <unfixed>
327    
328    gv
329            - evince <unfixed> (embed)
330            NOTE: ps/ tree from gv 3.5.8
331            - evince-gtk <unfixed> (embed)
332            NOTE: not packaged in Debian
333    
334    libXbae
335            [etch] - libpawlib2-lesstif <unfixed> (embed)
336            NOTE: from Cernlib
337    
338    libXaw
339            [etch] - libpawlib2-lesstif
340            NOTE: from Cernlib
341            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
342    
343    libgd2
344            - graphviz <unfixed> (embed)
345            NOTE: lib/gd seems to be 2.0.33
346    
347    rar
348            - unrar-nonfree <unfixed> (embed)
349    
350    unrar-free (maybe this code is derived from the original rar, too?)
351            - clamav <unfixed> (embed)
352            NOTE: seems to be disabled in default config
353    
354    mplayer (DirectMedia Object loader)
355            - xine-lib <unfixed> (embed)
356            NOTE: src/libw32dll/
357            - vlc <unfixed> (embed)
358            NOTE: modules/codec/dmo/
359    
360    libwpd (WordPerfect converter)
361            - openoffice.org <unfixed> (embed)
362    
363    fsplib (http://sourceforge.net/projects/fsp/)
364            - gftp <unfixed> (embed)
365            NOTE: lib/fsplib version 0.3
366    
367    librpcsecgss
368            - krb5 <unfixed> (embed)
369    
370    jasper
371            - ghostscript <unfixed> (embed)
372            - gs-gpl <unfixed> (embed)
373    
374    libidn
375            - monotone <unfixed> (embed)
376    
377    liblua
378            - monotone <unfixed> (embed)
379    
380    libbotan
381            - montone <unfixed> (embed)
382    
383    NetXX
384            - monotone <unfixed> (embed)
385    
386    libgc
387            - mono <unfixed> (embed)
388    
389    lzma
390            - p7zip <unfixed> (embed)
391    
392    lzo
393            - grub2 <unfixed> (embed)
394    
395    yassl
396            - mysql-dfsg-5.0 <unfixed> (embed)
397    
398    pax code
399            - tar <unfixed> (embed)
400            - cpio <unfixed> (embed)
401    
402    t1lib
403            - tetex-bin 2.0.2-1 (embed)
404            - texlive-bin <unknown> (embed)

Legend:
Removed from v.7136  
changed lines
  Added in v.7927

  ViewVC Help
Powered by ViewVC 1.1.5