/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 7214 by jmm-guest, Sun Nov 4 17:36:22 2007 UTC revision 15530 by silvio-guest, Wed Oct 27 04:13:33 2010 UTC
# Line 1  Line 1 
1  This file collects cases, where a source package embeds code from  Embedded code copies
2  other projects, without linking dynamically:  ====================
3    
4  xpdf code: (some use xpdf 2, some xpdf 3)  This file collects source packages that embed code from other projects.
5  gpdf (has been replaced by evince - which uses poppler - in Etch)  This is considered bad for fixing security flaws because the fix needs
6  pdftohtml (has been replaced by poppler-utils from the poppler source package, still in Etch, though)  to be applied in multiple source packages.
7  kdegraphics/kpdf (okular, the kpdf replacement in KDE 4 is using poppler, #436164)  
8  tetex-bin (links to poppler since 3.0-12)  Format:
9  cupsys (uses xpdf-utils, it's still present in the src, though)  <srcpkg> (<optional comment about srcpkg>)
10  poppler          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11  koffice/kword (upstream is working on using poppler, #436163)          NOTE: optional comments about the linkage of the embedding srcpkg
12  libextractor (uses internal pdf decoder since 0.5.12-1)  
13  pdfkit.framework (links to poppler since 0.8-4)  status: version number fixing the embedded copy
14  ipe (only small parts, but with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp)          <unfixed> if the issue is not yet fixed
15            <removed> if the package was removed from the archive
16  silc-toolkit:          <itp> if the package is in the process of being packaged
17  silc-client (uses libsilc and libsilcclient)          <not-affected> if the package does not use the embedded copy
18            <unknown> if the version number can not be determined
19  dietlibc:          <unfixable> for unavoidable cases (e.g., forks that add real value)
20  ccontrol (links statically)  sort: static (linking statically against a lib)
21          embed (embeds a copy of the library into another source package)
22  libiax:        modified-embed (embeds a code copy that differs from upstream code)
23  iaxmodem        fork (a full-blown fork of another source package)
24          old-version (an older version of essentially the same code)
 zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  
 dpkg  
 rsync (somehow derived code base)  
 mono  
 mozilla(?)  
 Linux kernels  
 pvpgn (links dynamically since 1.7.8-2)  
 mrtg (links dynamically since 2.12.2-1)  
 rpm  
25    
26  libbz2:  The srcpkg might be some string to identify the code if there is no
27  dpkg (statically linked)  specific source package.
28    
29    Everything up to the next line is ignored.
30    ---BEGIN
31    poppler
32            - pdftohtml <unknown>
33            [sarge] - pdftohtml <unfixed>
34            [etch] - pdftohtml <unfixed>
35            NOTE: has been replaced by poppler-utils
36            - kdegraphics 4:4.2.2-1 (embed; bug #436164)
37            - texlive-base 3.0-12 (embed)
38            - texlive-bin 2007-1 (embed)
39            - koffice 1:2.0.0-1 (embed; bug #436163)
40            - libextractor 0.5.12-1 (embed)
41            NOTE: libextractor is using its own pdf decoder now
42            - ipe <unfixed> (embed)
43            NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
44            - ruby-gnome2 <unknown> (embed)
45            - pdfedit <unfixed> (embed; bug #510794)
46            - swftools <removed> (embed; bug #551293)
47            - xpdf 3.02-9 (fork)
48    
49    pdksh (no longer developed since 1999)
50            - mksh <unfixable> (fork)
51            - posh <unfixable> (fork)
52    
53    ppmd
54            - libcomplearn-mod-ppmd <unfixed> (fork)
55            NOTE: discussion in #458152
56    
57    libevent
58            - transmission 1.71-1 (embed; bug #529372)
59            - chromium-browser 5.0.375.29~r46008-1
60            - dnsproxy <unknown> (embed)
61    
62    lrmi
63            - read-edid 2.0.0-1 (embed; bug #495131)
64            - s3switch <unfixed> (embed)
65            - xresprobe <unfixed> (embed)
66            - zhcon <unfixed> (embed)
67    
68    php-htmlpurifier
69            - mahara 1.2.5-1 (embed)
70            - knowledgeroot 0.9.9.5-5 (embed)
71            - moodle <unfixed> (embed)
72    
73    peercast
74            - gnome-peercast <removed> (embed)
75            [etch] - gnome-peercast <unfixed> (embed)
76    
77    silc-toolkit
78            - silc-client 1.1~beta6-1 (embed)
79    
80    icclib
81            - ghostscript <unfixed> (embed)
82            - argyll <unfixed> (embed)
83    
84    libusb
85            - argyll <unfixed> (embed)
86    
87    dietlibc
88            - ccontrol 0.9.1+20071204-1 (static)
89            - mksh <unfixable> (static)
90            NOTE: /bin/mksh-static only, and only on some arches (others use eglibc)
91    
92    libmikmod
93            - pysol-sound-server <unfixed> (modified-embed)
94            - sdl-mixer1.2 <unfixed> (embed)
95            TODO: report bug
96    
97    libiax
98            - iaxmodem <unfixable> (embed; bug #548885)
99    
100    spandsp
101            - iaxmodem <unfixable> (embed; bug #548885)
102    
103    python-paramiko
104            - fabric 0.9.0-2 (embed; bug #561398)
105    
106    zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
107            - dpkg 1.15.6 (static)
108            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
109            - rsync <unfixed> (embed)
110            - cherokee <unfixed> (embed)
111            NOTE: somehow derived code base
112            - mono <unfixed> (embed)
113            TODO: check mozilla
114            - Linux kernels <unfixed> (embed)
115            - pvpgn 1.7.8-2 (embed)
116            - mrtg 2.12.2-1 (embed)
117            - rpm <unknown> (embed)
118            NOTE: pinged anibal since when rpm was fixed
119            - tuxcmd-modules <unfixed> (embed)
120            - zsync <unfixed>
121            - tra <unfixed>
122            - sash <unfixed>
123            - nsis <unfixed>
124            - pyfits 1:2.3.1-1
125            - mseide-msegui <unfixed>
126            NOTE: mseide
127            - mirrordir <unfixed>
128            - poco <unfixed>
129            - klibc <unfixed>
130            - emboss <unfixed>
131            - ghostscript <unfixed>
132            - freeimage <unfixed>
133            - clamav <unfixed> (fork)
134            NOTE: from the changelog: "libclamav6 does indeed duplicate parts of the zlib code, but there is not way around that"
135            - tuxonice-userui <unfixed> (static)
136            - plt-scheme <unfixed>
137            - perl <unfixed>
138            - paraview <unfixed>
139            - velvet 0.7.56~nozlibcopy-1
140            - gcvs <unfixed>
141            - dump <unfixed>
142            - aide <unfixed> (static)
143            - dar <unfixed> (static)
144            - avfs <unfixed>
145            - fpc <unfixed>
146            - winff <unfixed>
147            NOTE: inherited from fpc, see #472304
148            - lazarus <unfixed>
149            NOTE: inherited from fpc, see #472304
150            - erlang <unfixed> (embed)
151            - gamera 3.2.3-1 (embed)
152            - python2.4 <unfixed> (embed; bug #553403)
153            - python2.5 <unfixed> (embed; bug #553403)
154            - texlive-bin <unknown> (embed)
155    
156    dulwich
157            - hg-git 0.1.0-1 (embed; bug #541996)
158    
159    libvigraimpex
160            - hugin <unfixed> (embed; bug #542259)
161            - enblend-enfuse <unfixed> (embed; bug #542258)
162            - gamera 3.2.3-1 (embed)
163    
164    libbz2
165            - dpkg 1.15.6 (static)
166            - amd64-libs <unfixed> (static)
167            NOTE: let's call it "static"
168            - dar <unfixed> (static)
169            - dump <unfixed> (static)
170            - unalz 0.64-1 (embed)
171            NOTE: has code, by the maint, to use the system version but links against the internal copy
172            - clamav <unfixed> (embed)
173            NOTE: libclamav/nsis/bzlib*
174            - pristine-tar <unfixable> (modified-embed)
175            NOTE: compression code only, not uncompression
176            - r-base-core-ra 1.2.8 (static)
177            - r-base-core 2.11.1 (static)
178            NOTE: links dynamically in squeeze, statically in lenny
179            - rpm <unfixed> (static)
180            NOTE: lsb-rpm package is statically linked, normal rpm links dynamically
181    
182    libyahoo2
183            - centerim <unfixed> (embed; bug #559783)
184    
185    libmsn
186            - centerim <unfixed> (embed; bug #559783)
187    
188    libgadu
189            - centerim <unfixed> (embed; bug #559783)
190            - pidgin <not-affected> (links dynamically since initial release; fixed in gaim)
191            - gaim 1:2.0.0+beta3-3 (embed; bug #360280)
192            - kdenetwork 4:3.3.2-5 (embed)
193            NOTE: from kdenetwork: kopete
194            - ekg 1:1.8~rc0-1 (embed)
195            - kadu 0.6.0.2-3 (embed; bug #504430)
196            - gadu <itp> (embed)
197    
198    xmlrpc (which package is the "origin" of this code?)
199            - drupal <unfixed> (embed)
200            - phpgroupware <unfixed> (embed)
201            - egroupware <unfixed> (embed)
202            - phpwiki <unfixed> (embed)
203            - php4 <removed> (embed)
204            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
205    
206    shtool (affects build-time only)
207            - mysql-ocaml <unfixed> (embed)
208            - php4 <removed> (embed)
209            - php5 <unfixed> (embed)
210    
 libgadu/ekg:  
 centericq  
 gaim  
 kopete (ships the code, but links dynamically in the Debian package)  
 kadu (not packaged in Debian)  
 GNU gadu (not yet packaged in Debian)  
   
 xmlrpc: (which package is the "origin" of this code?)  
 drupal  
 phpgroupware  
 egroupware  
 phpwiki  
 php4 (php-pear, IIRC this was reorganized some weeks ago?)  
 tikiwiki  
   
 shtool: (affects build-time only)  
 mysql-ocaml  
 php4  
   
 mozilla:  
 mozilla-firefox  
 mozilla-thunderbird  
 firefox (to be removed)  
 thunderbird (to be removed)  
 iceweasel  
 iceape  
 icedove  
211  xulrunner  xulrunner
212  nvu (no longer in Debian)          - iceape <unfixed> (embed; bug #561749)
213            - iceweasel 2.0.0.19 (embed)
214            - icedove <unfixed> (embed; bug #561750)
215            - kompozer <unfixed> (embed; bug #532168)
216            - galeon 2.0.2-4 (embed)
217            - epiphany-browser 2.14.3-8 (embed)
218            - conkeror 0.9~git080629-2 (embed)
219            - kazehakase 0.4.2-1 (embed)
220    
221    xli
222            - xloadimage <unfixed> (embed)
223    
224    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
225            - openmotif <unfixed> (embed)
226    
227    libxpm
228            - lesstif2 <unfixed> (embed; bug #575750)
229    
230    kerberized apps with BSD origin
231            - krb4 <removed> (embed)
232            - krb5 <unfixed> (embed)
233            - heimdal <unfixed> (embed)
234    
235    grip (which pkg is the origin?)
236            - libcdaudio <unfixed>
237            - grip <unfixed>
238            - gnome-vfs <unfixed>
239            TODO: check vfs2 as well
240    
241    fudforum
242            [etch] - phpgroupware <unfixed> (embed)
243            NOTE: phpgroupware-fudforum
244            [sarge] - egroupware-fudforum <removed> (embed)
245    
246    libbsd
247            - rdate 1:1.2-3 (embed)
248            - atheme-services <unfixed>
249            - libbsd-arc4random-perl <not-affected> (modified-embed)
250            NOTE: code not used, it links dynamically against libbsd instead
251            - isakmpd <unfixed>
252            - bsdgames <unfixed> (embed)
253            - bsd-mailx <unfixed> (embed)
254            - netcat-openbsd <unfixed> (embed; bug #550611)
255            - openssh <unfixed> (embed)
256            - unworkable <unfixed> (embed)
257            - mksh <unfixed> (modified-embed)
258            NOTE: strlcpy(), only used in /bin/mksh-static on eglibc arches
259            NOTE: FIXME, we should only have one entry: - mksh <not-affected> (modified-embed)
260            NOTE: strlcpy() on dietlibc arches; {g,s}etmode(); both unused
261    
262    cvs
263            - gcvs <unfixed> (embed)
264            NOTE: see cvsunix/src in tarball
265    
266    pcre3
267            - php4 <removed> (embed)
268            - analog 2:5.23-0woody1 (embed)
269            - goffice <unfixed> (embed)
270            NOTE: libgoffice-*
271            - vfu 4.06-4.1 (embed; bug #450754)
272            - tf5 5.0beta7-1 (embed)
273            - monotone 0.43-1 (embed)
274            NOTE: this only affects versions >= 0.37
275            - glib2.0 2.15.2-1 (embed)
276            - apache2 2.0.53-4 (embed)
277            - exim4 4.10-0.srh20.12 (embed)
278            - yacas <unfixed> (embed)
279            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
280            - gtamsanalyzer.app 0.42-5 (embed)
281            - tin 980117-1 (embed)
282            - kazehakase 0.5.2-1
283            - webkit 1.0.1-1 (embed)
284            - qt4-x11 <unfixed> (embed)
285            NOTE: embedded via webkit copy
286            - erlang <unfixed> (embed)
287            - ssed <unfixed> (embed)
288            - ircd-hybrid <unfixed> (static)
289            - emboss <unfixd>
290            - cherokee <unfixed> (embed)
291            - oftc-hybrid 1.6.9.dfsg-1 (embed)
292            - ratbox-services <unfixed> (embed)
293            - squeak-vm <unfixed> (embed)
294            - tinymux <unfixed> (embed)
295    
296    tiff
297            - wxwindows2.4 2.2.1 (embed)
298            - gamera 3.2.3-1 (embed)
299            - freeimage <unfixed> (embed)
300            - libtk-img <unfixed> (embed)
301            NOTE: there are two copies, one under tiff/ other under libtiff/
302            - gdal <unfixed>
303    
304    uudeview
305            - libconvert-uulib-perl <unfixed> (embed)
306            - pan <unfixed> (embed)
307    
308    sqlite (not affected by security vulnerabilities so far)
309            - amarok <unfixed> (embed)
310            - monotone 0.43-1 (embed)
311            - iceweasel <unfixed> (embed)
312            - heimdal <unfixed> (embed; bug #559616)
313    
314    util-linux/mount
315            - loop-aes-utils <unfixed> (embed)
316            NOTE: contains code from util-linux' mount in the mount-aes-udeb
317    
318    sylpheed
319            - sylpheed-claws <unfixed> (fork)
320    
321    phpsysinfo
322            - egroupware <unfixed> (embed)
323            - phpgroupware <unfixed> (embed)
324    
325    phpldapadmin
326            [sarge] - egroupware <unfixed> (embed)
327            NOTE: removed from egroupware after sarge
328    
329    chmlib
330            - kchmviewer <unknown> (embed)
331    
332    ffmpeg (libavcodec/libavformat)
333            - mplayer 1.0~rc2-14 (embed; bug #395252)
334            - kino 1.0.0-1
335            - vlc <not-affected> (Links dynamically since initial release)
336            - smilutils 0.3.0-10
337            NOTE: smilutils likely fixed earlier, marking Etch's version as fixed
338            - motion 3.1.19-1
339            - gstreamer0.10-ffmpeg 0.10.3-2
340            - xmovie <removed> (static)
341            TODO: gimp-gap (potentially using ffmpeg code as well)
342            - avifile 1:0.7.48~20090503.ds-1 (embed; bug #538750)
343            - audacity 1.3.7-2 (embed; bug #512278)
344            - chromium-browser <unfixed> (fork)
345    
346    faad2
347            - mplayer 1.0~rc2-20 (embed)
348            - avifile <unfixed> (embed; bug #538750)
349            - ffmpeg-debian <removed> (embed)
350    
351    libmad (MPEG decoding lib)
352            - xine-lib <unfixed> (embed)
353            - avifile 1:0.7.48~20090503.ds-1 (embed) [./plugins/libmad/*]
354            TODO: check ocaml-mad, madplay, pymad, xmms-mad, xmms2
355    
356  xli:  libdts
357  xloadimage          - xine-lib <unfixed> (embed)
358    
359  lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)  flac
360  openmotif          - xine-lib <unfixed> (embed)
 xfree86/xorg (in libxpm)  
   
 kerberized apps with BSD origin:  
 krb4  
 krb5  
 heimdal  
   
 grip: (which pkg is the origin?)  
 libcdaudio  
 grip  
 gnome-vfs (vfs2 as well?)  
   
 fudforum:  
 phpgroupware-fudforum  
 egroupware-fudforum (removed from egroupware after sarge)  
   
 cvs:  
 gcvs (at least an additional script is included, check if there's more)  
   
 pcre:  
 all pythons  
 php4 (src included, but Debian package links dynamically)  
 analog (src included, but Debian package links dynamically)  
 libgoffice-1  
 vfu  
 tf5 (since 5.0beta7 the Debian package links dynamically)  
 monotone (including this starting from 0.37)  
   
 tiff:  
 wxpythongtk (check, which debian pkg this is in)  
 older kdegraphics/kpdf releases < 3.3 embedded a copy  
   
 uudeview:  
 libconvert-uulib-perl  
   
 sqlite: (not affected by security vulnerabilities so far)  
 amarok  
 monotone  
 iceweasel  
   
 util-linux/mount:  
 loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb  
   
 webmin:  
 usermin (only in sarge)  
   
 sylpheed:  
 sylpheed-claws  
   
 phpsysinfo:  
 egroupware  
 phpgroupware  
   
 phpldapadmin:  
 egroupware (removed from egroupware after sarge)  
   
 chmlib:  
 kchmviewer (not packaged in Debian)  
   
 libavcodec/libavformat (source: ffmpeg):  
 mplayer (#395252)  
 xvidcap  
 kino (links statically, does not include code)  
 vlc (links statically, does not include code)  
 smilutils (links statically, does not include code)  
 motion (links statically, does not include code)  
 gst-ffmpeg  
 gstreamer0.10-ffmpeg  
 xmovie  
361    
362  mad MPEG decoding lib:  liba52
363  mad          - a52dec <unfixed> (embed)
364  xine-lib          - xine-lib <unfixed> (embed)
365    
366    mpeg2dec (libmpeg2)
367            - xine-lib <unfixed> (embed)
368    
369    libmpeg3
370            - squeak-vm <unfixed> (embed)
371    
372    libntlm
373            - wget <unfixed> (fork; bug #550436)
374            - curl <unfixed> (fork; bug #550437)
375            - cntlm <unfixed> (fork; bug #550438)
376    
377    uw-imap
378            - pine <unfixed> (embed)
379            - alpine <unfixed> (embed)
380    
381    imagemagick
382            - graphicsmagick <unfixed> (fork)
383    
384    python-urlgrabber
385            - mercurial <unfixed> (embed; bug #531062)
386            - w3af <unfixed> (embed; bug #555372)
387            [experimental] - harvestman <unfixed> (embed; bug #555373)
388    
389    beautifulsoup
390            - python-mechanize <unfixed> (embed; bug #555349)
391            - zope2.11 <removed> (embed; bug #555350)
392            - twill <unknown> (embed)
393    
394    halibut
395            - nsis <unfixed> (fork)
396    
397    libghttp
398            - hotway <unfixed> (embed)
399    
400    libsndfile
401            - ardour 1:2.7.1-1 (embed)
402    
403    glibmm2.4
404            - ardour 1:2.7.1-1 (embed)
405    
406    libgnomecanvasmm2.6
407            - ardour 1:2.7.1-1 (embed)
408    
409    libsigc++-2.0
410            - ardour 1:2.7.1-1 (embed)
411    
412    soundtouch
413            - ardour 1:2.7.1-1 (embed)
414    
415    libmms
416            - xine-lib <unfixed> (embed)
417            - mimms <unfixed> (embed)
418    
419    fckeditor
420            - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
421            - moin 1.8.2-2 (embed; bug #452599)
422            - karrigell <removed> (embed; bug #452598)
423            - gforge 4.6.99+svn6225-1 (embed)
424            - request-tracker3.8 <unfixed> (embed)
425            - otrs2 <unfixed> (embed)
426    
427    ipatlas (not packaged in Debian)
428            - moodle <unfixed> (embed; bug #507185)
429    
430    libphp-phpmailer
431            - moodle <unfixed> (embed; bug #507185)
432            - mahara <unfixed> (embed)
433            - symfony <unfixed> (embed; bug #566778)
434            [etch] - phpgroupware <unfixed> (embed)
435            NOTE: phpgroupware-felamimail is only in etch
436            - egroupware <unfixed> (embed; bug #504283)
437            - glpi <unfixed>
438    
439    htmlArea (not packaged in Debian)
440            - moodle <unfixed> (embed)
441    
442    giflib
443            - wine <unfixed> (embed; bug #466181)
444    
445    bennu (not packaged in Debian, http://bennu.sourceforge.net)
446            - moodle <unfixed> (embed)
447    
448    smarty
449            - moodle 1.8.2-2 (embed; bug #471158)
450            - gallery2 2.2.5-2 (embed; bug #471160)
451            - mahara 0.9.2-2 (embed; bug #471201)
452            - gosa 2.4beta1-1 (embed; bug #471200)
453    
454  libdts:  TinyMCE
455  libdts          - wordpress 2.5.1-3 (embed; bug #478257)
456  xine-lib          - moodle <unfixed> (embed; bug #507185)
457            - knowledgeroot <unfixed> (embed)
458            - joomla <itp> (bug #326398)
459            - mahara 1.2.6-1 (embed; #597752)
460    
461    scintilla (upstream provides static lib, rejected shared lib http://sf.net/support/tracker.php?aid=2488121)
462            - scite <unfixed> (embed)
463            - qscintilla <unfixed> (embed)
464            - qscintilla2 <unfixed> (embed)
465            - geany <unfixed> (fork)
466            - anjuta <unfixed> (embed)
467    
468    libphp-adodb
469            - moodle <unfixed> (embed; bug #507185)
470            NOTE: also AdoDB-XML Schema
471            - gallery2 <unfixed> (embed)
472            - phppgadmin <unfixed> (embed)
473            - egroupware <unfixed> (embed)
474            - phpwiki <unfixed> (embed)
475            - torrentflux 2.0beta1-2 (embed)
476            - ipplan <unfixed> (embed)
477            - typo3-src <unfixed> (embed)
478            - cacti <unknown> (embed)
479            [sarge] - cacti <unfixed> (embed)
480            NOTE: dependency exists, but internal version is used
481            - gforge 4.7~rc2-6 (embed)
482            - mahara <unfixed> (embed)
483    
484    gzip
485            - linux-2.6 <unfixed> (embed) [lib/inflate.c]
486            - klibc <unfixed> (embed)
487            NOTE: based on linux-kernel gzip code
488            - busybox <unfixed> (embed)
489            - pristine-tar <unfixed> (modified-embed)
490            NOTE: compression code only, not uncompression
491            - ncompress <unfixed> (old-version)
492    
493    neon
494            - cadaver 0.22.3+debian-1 (embed; bug #188381)
495            - gnome-vfs2 <unfixed> (embed; bug #395874)
496            [etch] - litmus <unfixed> (embed; #395875)
497            - litmus <removed> (embed; #395875)
498            [sarge] - screem <unfixed> (embed)
499            - sitecopy 1:0.16.0-1 (embed; bug #395876)
500            [etch] - tla <unfixed> (embed; bug #395877)
501            [sarge] - tla <unfixed> (embed; bug #395877)
502    
503    libmodplug
504            - gst-plugins-bad0.10 0.10.10.2-1 (embed)
505    
506    libvncserver
507            - vino <unfixed> (embed)
508    
509    putty
510            - filezilla <unfixed> (embed)
511    
512    tinyxml (not packaged in Debian; itp bug #531968)
513            - filezilla <unfixed>
514            - crystalspace <unfixed> (embed)
515            - libwfut <unfixed> (embed)
516            - rarian <unfixed> (embed)
517            - bulletml <unfixed> (embed)
518            - pokerth <unfixed> (embed)
519            - qutecom <unfixed> (embed)
520            - sofa-framework <unfixed> (embed)
521            - yate <unfixed> (embed)
522            - antigrav <unfixed> (embed)
523            - balder2d <unfixed> (embed)
524            - cal3d <unfixed> (embed)
525            - criticalmass <unfixed> (embed)
526            - ember <unfixed> (embed)
527            - epiphany <unfixed> (embed)
528            - gambit <unfixed> (embed)
529            - noiz2sa <unfixed> (embed)
530            - ogre <unfixed> (embed)
531            - opencity <unfixed> (embed)
532            - openmovieeditor <unfixed> (embed)
533            - pouetchess <unfixed> (embed)
534            - tecnoballz <unfixed> (embed)
535            - trigger-rally <unfixed> (embed)
536            - xmoto <unfixed> (embed)
537            - mapnik <unknown> (embed)
538            NOTE: uses a different XML parser by default
539            - rrootage 0.23a-6 <embed>
540            NOTE: links to libbulltetml
541            - boson <unknown> (embed)
542            NOTE: the embedded code is unused
543    
544    gv
545            - evince <unfixed> (embed)
546            NOTE: ps/ tree from gv 3.5.8
547            NOTE: evince-gtk is affected (a component of evince source package)
548    
549    libXbae
550            - paw <unfixed> (embed)
551    
552    libgtkhtml
553            - claws-mail-extra-plugins <unfixed> (fork)
554    
555    libXaw
556            - paw <unfixed> (embed)
557            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
558    
559    libgd2
560            - graphviz <unfixed> (embed)
561            NOTE: lib/gd seems to be 2.0.33
562            - wml 2.0.11ds2-1 (embed)
563            - libwmf <unfixed> (embed)
564            NOTE: derived from gd 1.6.3
565            - plt-scheme <unfixed> (embed; bug #601525)
566            - texlive-bin 2009-1 (embed)
567    
568    rar
569            - unrar-nonfree <unfixed> (embed)
570    
571    unrar-free (maybe this code is derived from the original rar, too?)
572            - clamav <unfixed> (embed)
573            NOTE: seems to be disabled in default config
574    
575    mplayer (DirectMedia Object loader)
576            - xine-lib <unfixed> (embed)
577            NOTE: src/libw32dll/
578            - vlc <unfixed> (embed)
579            NOTE: modules/codec/dmo/
580            - mplayer 1.0~rc2-20 (embed)
581    
582    libwpd (WordPerfect converter)
583            - openoffice.org <unfixed> (embed)
584    
585    fsplib (http://sourceforge.net/projects/fsp/)
586            - gftp <unfixed> (embed)
587            NOTE: lib/fsplib version 0.3
588    
589    sprng
590            - tree-puzzle <unfixed> (embed)
591    
592    librpcsecgss
593            - krb5 <unfixed> (embed)
594    
595    jasper
596            - ghostscript 8.64~dfsg-2 (embed)
597    
598    libiris
599            - psi <unfixed> (embed)
600            - kdenetwork <unfixed> (embed)
601            NOTE: kopete embeds libiris but links dynamically to libidn
602            - kdegames <unfixed> (embed)
603            NOTE: ksirk/kde4
604    
605    libidn
606            - monotone 0.43-1 (embed)
607            - psi <unfixed> (embed)
608            NOTE: psi embeds libiris which embeds libidn
609            - kdegames <unfixed> (embed)
610            NOTE: kdegames/kde4 embeds libiris which embeds libidn
611    
612    lua5.1
613            - monotone 0.43-1 (embed)
614            - nmap 5.00-1 (embed; bug #527997)
615            [lenny] - nmap <unfixed> (embed; bug #527997)
616            - ocropus <unfixed> (embed)
617            - enigma <unfixed> (embed)
618            NOTE: requires lua built with C++
619            - freeciv <unfixed> (embed)
620            - spring <unfixed> (embed)
621    
622    libbotan
623            - monotone 0.43-1 (embed)
624    
625    NetXX
626            - monotone 0.43-1 (embed)
627    
628    libgc
629            - mono <unfixed> (embed)
630    
631    lzma
632            - p7zip <unfixed> (embed)
633            - xz-utils <unfixed> (fork)
634            - r-base <unfixed> (embed)
635            NOTE: lzma support not yet in lenny or in r-base-core-ra 1.2.8
636    
637    lzo
638            - grub2 <unfixed> (embed)
639    
640    yassl
641            - mysql-dfsg-5.0 <unfixed> (embed)
642            - mysql-5.1 <unfixed> (embed)
643    
644    pax code
645            - tar <unfixed> (embed)
646            - cpio <unfixed> (embed)
647    
648    t1lib
649            - tetex-bin 2.0.2-1 (embed)
650            - texlive-bin <unknown> (embed)
651            - grace 5.1.14-2 (embed)
652            NOTE: Might be fixed even earlier
653    
654    guichan
655            - boswars <unfixed> (embed)
656            NOTE: maintainer notified us, working on it
657    
658    tolua
659            - boswars <unfixed> (embed)
660            NOTE: maintainer notified us, working on it
661            NOTE: actually tolua++
662            - ocropus <unfixed> (embed)
663            NOTE: actually tolua++
664            - freeciv <unfixed> (embed)
665            NOTE: actually tolua++
666            - enigma <unfixed> (embed)
667    
668  flac:  asio-dev
669  flac          - luxrender <removed> (embed)
 xine-lib  
670    
 liba52:  
 a52dec  
671  xine-lib  xine-lib
672            - vlc <unfixed> (embed)
673            NOTE: only parts included in modules/access/rtsp
674    
675  libmpeg2:  netpbm
676  mpeg2dec          - tcl8.3 <unfixed> (embed)
677  xine-lib          - tcl8.4 <unfixed> (embed)
678            - tcl8.5 <unfixed> (embed)
679            NOTE: generic/tkImgGIF.c
680    
681    tk8.5
682            - tk8.0 <removed> (old-version)
683            - tk8.3 <unfixed> (old-version)
684            - tk8.4 <unfixed> (old-version)
685            - perl-tk <unfixable> (fork)
686    
687    samba
688            - mc 2:4.6.2~git20080311-1 (embed)
689            NOTE: maintainer is aware of this, currently searching a solution
690    
691    plib1.8.4c2
692            - boson <unfixed> (fork)
693            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
694    
695    fribidi
696            - quesoglc 0.7.2-2 (embed)
697    
698    glew
699            - quesoglc <unfixed> (embed; bug #489341)
700            NOTE: waiting on GLEW_MX version of glew (see bug #474488)
701            - trigger 0.5.2.1-2 (embed)
702            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
703            - trigger-rally 0.5.2.1-2 (embed)
704            NOTE: http://lists.debian.org/debian-devel-games/2009/12/msg00007.html
705            - chromium-browser 5.0.375.70~r48679-2
706    
707    minorGems (pabs contacted upstream about shared lib, he considers minorGems an 'ever-evolving collection of reusable code fragments' for his own use)
708            - transcend <unfixed> (embed)
709            - cultivation <unfixed> (embed)
710            - passage <unfixed> (embed)
711            - gravitation <unfixed> (embed)
712    
713  curl:  tar
714  wget (code for NTLM authentication)          - libarchive <unfixed> (embed)
715            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
716    
717  TODO evaluate:  cpio
718  gimp-gap (potentially using ffmpeg code as well)          - libarchive <unfixed> (embed)
719            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
720    
721  uw-imap:  kde4libs
722  pine          - kdelibs <unfixable> (old-version)
 alpine  
723    
724  imagemagick:  webkit
725  graphicsmagick          - qt4-x11 <unfixed> (embed; bug #479851)
726            [etch] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
727            - kde4libs <unfixable> (fork)
728            NOTE: kde4lib's khtml and webkit were forked from khtml (this tracking, which seems
729            NOTE: reversed genesis-wise, is used because of so much other stuff in kde4libs)
730            - chromium-browser <unfixed> (fork)
731    
732    ftgl
733            - blender 2.46+dfsg-1 (embed)
734    
735    wv
736            - abiword <unfixed>
737    
738    qemu
739            - kvm <removed> (embed; bug #543159)
740            - qemu-kvm <unfixed> (embed; bug #560853)
741            NOTE: kvm superceded by qemu-kvm, which is just user interface (no modules)
742            - xen-3 3.4.2-2 (embed; bug #560856)
743            - xen-unstable <unfixed> (embed; bug #560856)
744    
745    vgabios
746            - kvm <removed> (embed; bug #489442)
747            - qemu-kvm <unfixed> (embed)
748    
749    bochs
750            - kvm <removed> (embed; bug #489442)
751            - qemu-kvm <unfixed> (embed)
752    
753    speex
754            - vorbis-tools <unfixed> (embed)
755            NOTE: while comiled against libspeex-dev, ogg123/speex_format.c is compiled with embedded code copied from speexdec.c
756            - gst-plugins-good0.10 <unfixed> (embed)
757            - xine-lib <unfixed> (embed)
758            - libfishsound <unfixed> (embed)
759            - libannodex <removed> (embed)
760            - opal 3.4.2~dfsg-2 (embed)
761            - mumble 1.2.0~beta1-1 (embed)
762            - vlc <unfixed> (embed)
763            - xmms-speex <unfixed> (embed)
764            - libsdl-sound1.2 <unfixed> (embed)
765            - sweep <unfixed> (embed)
766    
767    libreadline
768            - magic <itp> (old-version)
769    
770    opcode
771            - ode <unfixed> (embed)
772            NOTE: opcode is not a package in debian, it is just embedded
773            NOTE: http://www.codercorner.com/Opcode.htm
774    
775    gimpact
776            - ode <unfixed> (embed)
777            NOTE: gimpact is not a package in debian, it is just embedded
778            NOTE: http://gimpact.sf.net
779    
780    mochikit
781            - mahara <unfixed> (embed)
782            NOTE: they require extra patches, still unmerged upstream
783            - ntop <unfixed> (embed)
784            - coherence 0.6.2-1 (embed)
785            - paste <unfixed> (embed)
786            - turbogears <unfixed> (embed)
787            - plone3 <removed> (embed)
788            - xulrunner <unfixed> (embed)
789            - libjifty-plugin-chart-perl <unfixed> (embed)
790            - sabnzbdplus <unfixed> (embed)
791            - tgmochikit <unfixed> (embed)
792    
793    prototypejs
794            - netbeans-ide 6.0.1+dfsg-2 (embed)
795            - auth2db 0.2.5-2+dfsg-1 (embed; bug #555218)
796            - webcit <unfixed> (embed; bug #555219)
797            - asterisk 1:1.6.2.0~rc3-1 (embed)
798            - libjson-ruby 1.1.4-1 (embed; bug #555224)
799            - lucene2 2.9.1+ds1-2 (embed; bug #555226)
800            - horde3 <unfixed> (embed)
801            - knowledgeroot 0.9.8.5-4 (embed; bug #555230)
802            - mediatomb 0.12.0~svn2018-5 (embed; bug #555233)
803            - mt-daapd 0.9~r1696.dfsg-6lenny2 (embed)
804            - ebug-http <unfixed> (embed; bug #555236)
805            - libaws 2.7-1 (embed; bug #555222)
806            - phpgedview <removed> (embed)
807            - poker-network 1.7.6-1 (embed; bug #555238)
808            - rails 2.1.0-6 (embed)
809            - wordpress 2.5.0-2 (embed; bug #555243)
810            - zope <not-affected> (the prototypejs embed is not in any of the obvious zope packages, e.g. zope2.9, zope2.10, zope2.11, and zope3)
811            TODO: search through all of the other zope packages
812            - ampache 3.4.1-2 (embed)
813            - exaile 0.2.14+debian-2.1 (embed; bug #555245)
814            - hobix 0.5~svn20070319-4 (embed; bug #555247)
815            - zabbix 1.6.6-4 (embed; bug #555250)
816            - chora2 2.1.1+debian0-1 (embed; bug #555253)
817            - gollem 1.1.1+debian0-1 (embed; bug # 555254)
818            - jscropperui 1.2.1-1 (embed; bug #555257)
819            - scriptaculous <not-affected> (uses system prototype.js since initial upload; bug #555260)
820            - ingo1 1.2.3+debian0-1 (embed; bug #555261)
821            - kronolith2 2.3.3+debian0-1 (embed; bug #555262)
822            - activeldap 1.2.1-1 (embed)
823            - libv8 <not-affected> (contains a google-specific implementation of prototype.js)
824            - mantis 1.1.2+dfsg-1 (embed; bug #555265)
825            - otrs2 2.3.4-6 (embed; bug #555267)
826            - webcalendar 1.2~b1-2 (embed; bug #555269)
827            - redmine 0.9.0~svn2907-1 (embed; bug #555270)
828            - jifty 0.90519-1 (embed; bug #555271)
829            - jquery 1.4-1 (embed; bug #555272)
830            - passenger 2.2.5debian1-1 (embed; bug #555273)
831            - plone3 <removed> (embed; bug #555275)
832            - wesnoth <not-affected> (prototype.js not included in any of the binary packages; bug #555277)
833            - libhtml-prototype-perl 1.48-3 (embed; bug #538920)
834            - xulrunner <unfixed> (embed)
835            NOTE: included in iceweasel/xulrunner unit tests directory, so may not be security-relevant
836            - jclicmoodle <unfixed> (embed)
837            - git-cola <unfixed> (embed)
838    
839    gdb
840            - insight <unfixed> (embed)
841    
842    e2fsprogs
843            - ldiskfsprogs <unfixable> (fork)
844    
845    quazip (not packaged in Debian)
846            - qcake <unfixed> (embed)
847            NOTE: starting with upstream version 0.6.4
848    
849    exo
850            - pcmanfm <unfixed> (embed; bug #499677)
851            NOTE: slightly modified source code
852    
853    java
854            - openjdk-6 <unfixed>
855            - sun-java5 <unfixed>
856            - sun-java6 <unfixed>
857    
858    libphp-snoopy
859            - ampache 3.4.1-2 (embed; bug #504169)
860            - gforge 4.6.99+svn6094-2 (embed)
861            - mahara 1.0.5-2 (embed; bug #504170)
862            - pixelpost 1.7.1-5 (embed; bug #504171)
863            - mediamate 0.9.3.6-5 (embed; bug #504172)
864            - opendb <removed> (embed; bug #504173)
865            [etch] - opendb <unfixed> (embed; bug #504173)
866            - wordpress 2.5.1-9 (embed; bug #443948)
867            - moodle <unfixed> (embed; bug #507185)
868            [etch] - phpgroupware <unfixed> (embed)
869            NOTE: phpgroupware-felamimail
870            - magpierss 0.72-3 (embed; bug #431089)
871    
872    jquery
873            - zekr <unfixed> (embed)
874            - wordpress <unknown> (embed)
875            - yocto-reader <unfixed> (embed)
876            - textpattern <unfixed> (embed)
877            - genshi 0.5.1-1 (embed)
878            NOTE: compressed file under examples/ dir
879            - prewikka <unfixed> (embed)
880            - libramaze-ruby <unfixed> (embed)
881            - drupal6 <unfixed> (embed)
882            - b2evolution <unfixed> (embed)
883            - wesnoth <unfixed> (embed)
884    
885    tablesorter (jquery plugin, not packaged yet)
886            - wesnoth <unfixed> (embed)
887    
888    kses
889            - wordpress <unfixed> (embed; bug #504242)
890            NOTE: their copy has all methods renamed to wp_<foo>
891            NOTE: kses isn't in Debian, RFP: #504240
892            - moodle <unfixed> (embed; bug #507185)
893            - egroupware <unfixed> (embed)
894    
895    magpierss
896            - wordpress <unfixed> (embed; bug #504242)
897            - moodle <unfixed>
898    
899    php-gettext
900            - wordpress 2.8.4-1 (embed; bug #504242)
901            - docbookwiki <unfixed> (embed)
902            - knowledgeroot 0.9.9.5-1
903            NOTE: non-free
904    
905    libphp-ixr (name may change, it is the Incutio XML-RPC)
906            - wordpress <unfixed> (embed; bug #504242)
907            NOTE: libphp-ixr isn't in Debian, RFP: #504236
908            - dokuwiki <unfixed> (embed)
909            - textpattern <unfixed> (embed)
910    
911    libphp-cas
912            - glpi <unfixed> (embed)
913            - moodle <unfixed> (embed; bug #505984)
914    
915    scriptaculous (prototype.js is among the embeds in the following)
916            - glpi <unfixed> (embed)
917            - libaws <unfixed> (embed; bug #555222)
918            - op-panel <unfixed> (embed)
919            - symfony <unfixed> (embed)
920            NOTE: maintainer says there are extra incompatible changes required
921            - pixelpost 1.7.1-6 (embed)
922            - webhelpers <unfixed> (embed)
923            - qwik <removed> (embed; bug #555241)
924            - smokeping <unfixed> (embed)
925            - turba2 <unfixed> (embed)
926            - typo3-src 4.2.3-1 (embed)
927            - request-tracker3.6 <unfixed> (embed)
928            - request-tracker3.8 <unfixed> (embed)
929            - rt-extension-emailcompletion <not-affected> (prototype.js not included in the binary package)
930            - wordpress 2.5.0-2 (embed)
931            - libhtml-prototype-perl 1.48-3 (embed)
932    
933    libmarkdown-php
934            - moodle <unfixed> (embed; bug #507185)
935            - pixelpost 1.7.1-6 (embed)
936    
937    php-openid
938            - wordpress-openid 3.3.2-1 (embed)
939    
940    geshi
941            - dokuwiki 0.0.20080505-3.1 (embed)
942            - pgfouine 1.0-1.1 (embed)
943            - websvn 2.1.0-1 (embed)
944    
945    webcalendar
946            - gforge 4.7~rc2-6 (embed; bug #504758)
947    
948    libical
949            - kdepim <unknown> (fork)
950            NOTE: fixed at some point during 4.0
951            - kdepimlibs 4.2.0-1 (fork)
952            - claws-mail-extra-plugins <unfixed> (fork)
953    
954    harfbuzz
955            - qt4-x11 <unfixed> (embed)
956            - pango1.0 <unfixed> (embed)
957            - fontmatrix <unfixed> (embed)
958    
959    libzip
960            - php5 <unfixable> (modified-embed)
961            - odt2txt <unfixed> (embed; bug #523808)
962    
963    json.php (not packaged; should be replaced with php's built-in functions)
964            - moodle <unfixed>
965            - yui <unfixed>
966            - gallery2 <unfixed>
967            - dokuwiki <unfixed>
968            - typo3-src <unfixed>
969    
970    php-fpdf
971            - tcpdf <itp> (fork)
972            - moodle <unfixed>
973            - phpwiki <unfixed>
974            - egroupware <unfixed>
975            - ldap-account-manager <unfixed> (fork)
976    
977    tcpdf (itp: #495985)
978            - moodle <unfixed>
979            - phpmyadmin <unfixed>
980    
981    typo3
982            - moodle <unfixed>
983    
984    spreadsheet_writeexcel (PHP port of libspreadsheet-writeexcel-perl; itp: #487557)
985            - moodle <unfixed>
986            - gosa <unfixed>
987    
988    php-ole (itp: #487558)
989            - moodle <unfixed>
990    
991    pieforms (http://www.catalyst.net.nz)
992            - mahara <unfixed>
993    
994    savant2 (http://phpsavant.com)
995            - egroupware <unfixed>
996    
997    rssparser (http://nwow.org)
998            - egroupware <unfixed>
999            - phpgroupware <unfixed>
1000    
1001    lcms
1002            - openjdk-6 <unfixed> (fork)
1003            - gimp 2.4.0~rc2-2
1004    
1005    libphp-phplayersmenu
1006            - diogenes <unfixed>
1007            - phpldapadmin <unfixed>
1008    
1009    libphp-pclzip
1010            - docvert <unfixed>
1011            - moodle <unfixed>
1012            - egroupware <unfixed>
1013    
1014    libphp-simplepie
1015            - dokuwiki <unfixed>
1016            - wordpress <unfixed>
1017    
1018    libphp-jpgraph
1019            - egroupware <unfixed>
1020    
1021    php-simpletest
1022            - moodle <unfixed>
1023    
1024    libpng
1025            - iceweasel <not-affected> (uses xulrunner)
1026            - icedove 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1, 2.0.0.19-1 (embed)
1027            - iceape 1.0.13~pre080614i-0etch1 (embed)
1028            - xulrunner 1.9.0.13-1 (embed)
1029            [lenny] - xulrunner 1.9.0.11-0lenny1
1030            [etch] - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
1031            - gamera 3.2.3-1 (embed)
1032            - freeimage <unfixed> (embed)
1033            - tuxonice-userui <unfixed> (static)
1034    
1035    irssi
1036            - silc-client <unfixed> (embed)
1037            NOTE: Seems to be a pre-0.8.12 version that is used in irssi-plugin-silc
1038    
1039    extc
1040            - mtasc <unfixed> (embed)
1041            - haxe <unfixed> (embed)
1042    
1043    swflib
1044            - mtasc <unfixed> (embed)
1045            - haxe <unfixed> (embed)
1046    
1047    libitext-java
1048            - bouncycastle 2.1.4-1 (embed)
1049    
1050    python-ply
1051            - pyke <unfixed> (embed; bug #555363)
1052            - pywbem 0.7.0-4 (embed; bug #555364)
1053            - sepolgen <unfixed> (embed; bug #555365)
1054            - zope-textindexng3 <unknown> (embed)
1055            - iceweasel <not-affected> (uses xulrunner)
1056            - xulrunner <unknown> (embed)
1057            - wireshark <not-affected> (python-ply modules are not installed into binary packages; see #554613)
1058    
1059    libdumbnet (libdnet upstream)
1060            - nmap <unfixed> (fork)
1061    
1062    gcc-4.4
1063            - gcc-mingw32 <unfixed> (embed)
1064    
1065    camlimages
1066            - advi <unfixed> (static; bug #550441)
1067    
1068    memcached
1069            - memcachedb <unfixed> (embed)
1070    
1071    yajl
1072            - argyll <unfixed> (embed; bug #544223)
1073            NOTE: reference, confirmed by build logs: http://lists.debian.org/debian-mentors/2009/08/msg00062.html
1074    
1075    nusoap
1076            - gforge 4.8.2-1 (embed)
1077            - ampache <unfixed> (embed)
1078            - poker-network <unfixed> (embed)
1079            - moodle <unfixed> (embed)
1080            NOTE: code is not used when running under php5 and soap is enabled
1081            - phpwiki <unfixed> (embed)
1082            - gallery2 <unfixed> (embed)
1083            - typo3-src <unfixed> (embed)
1084            - phpgacl 3.3.7-7 (embed)
1085            - mantis 1.1.8+dfsg-1 (embed)
1086    
1087    libept
1088            - adept <unfixed> (embed; bug #540649)
1089    
1090    libvorbis
1091            - iceweasel <not-affected> (uses xulrunner)
1092            - xulrunner <unfixed> (embed; bug #540959)
1093            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1094            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1095            - iceape <unfixed> (embed)
1096            [etch] - iceape <not-affected> (introduced in 2.0)
1097            [lenny] - iceape <not-affected> (introduced in 2.0)
1098    
1099    cairo
1100            - iceweasel <not-affected> (uses xulrunner)
1101            - xulrunner 1.8.0.15~pre080614i-0etch1 (embed)
1102    
1103    liboggz
1104            - iceweasel <not-affected> (uses xulrunner)
1105            - xulrunner <unfixed> (embed; bug #540959)
1106            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1107            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1108            - iceape <unfixed> (embed)
1109            [etch] - iceape <not-affected> (introduced in 2.0)
1110            [lenny] - iceape <not-affected> (introduced in 2.0)
1111    
1112    liboggplay
1113            - iceweasel <not-affected> (uses xulrunner)
1114            - xulrunner <unfixed> (embed; bug #540959)
1115            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1116            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1117            - iceape <unfixed> (embed)
1118            [etch] - iceape <not-affected> (introduced in 2.0)
1119            [lenny] - iceape <not-affected> (introduced in 2.0)
1120    
1121    php-net-dnsbl
1122            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1123    
1124    php-onyx-rss
1125            - serendipity <unfixed> (embed; bug #541740; wontfix: only one script, own package is overkill, appears not to be duplicated in Debian)
1126    
1127    php-text-wiki
1128            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1129    
1130    php-xml-rpc
1131            - serendipity <unfixed> (embed; bug #541740; package in NEW)
1132    
1133    polarssl (does not have a shared library)
1134            - pdkim <itp> (embed; bug #543150)
1135            - xyssl <unfixed> (old-version)
1136    
1137    pidgin (libpurple)
1138            - gaim <removed> (old-version)
1139            - qutecom 2.2~rc3.hg396~dfsg1-6 (embed; bug #559785)
1140    
1141    icu
1142            - webkit 1.0.1-1 (embed; bug #547214)
1143            - texlive-bin <unfixed> (fork)
1144            NOTE: texlive upstream working with icu upstream to merge their changes
1145            - chromium-browser 5.0.375.29~r46008-3
1146    
1147    cyrus-imapd-2.2
1148            - kolab-cyrus-imapd <unfixed> (fork)
1149            - dovecot 1:1.2.1-1 (embed) [/dovecot-sieve/src/libsieve/*]
1150    
1151    python-cxx-dev
1152            - freecad 0.9.2646.3-1 (embed; bug #547936)
1153    
1154    zipios++
1155            - freecad 0.9.2646.3-1 (embed; bug #547941)
1156            - enigma 0.92.3-3 (embed)
1157            NOTE: likely fixed earlier, marking etch's version as fixed
1158    
1159    linux-2.6
1160            - kvm <removed> (embed; bug #549973) [./kernel/*]
1161            - linux-kbuild-2.6 <unfixed> (embed; bug #550379) [./kbuild/*]
1162            - kernel-source-2.6.8 <removed> (old-version)
1163            - kernel-source-2.4.27 <removed> (old-version)
1164            - kernel-source-2.4.24 <removed> (old-version)
1165            - kernel-source-2.2.25 <removed> (old-version)
1166            - kernel-source-2.2.20 <removed> (old-version)
1167    
1168    libfdt (not yet packaged separately for debian; http://www.jdl.com/software/)
1169            - kvm <removed> (embed) [./libfdt/*]
1170            - qemu-kvm <unfixed> (embed) [./libfdt/*]
1171    
1172    qweb (not packaged)
1173            - ajaxterm <unfixed>
1174    
1175    opensaml2
1176            - opensaml <removed> (old-version)
1177    
1178    shibboleth-sp2
1179            - shibboleth-sp <removed> (old-version)
1180    
1181    tuxonice-userui
1182            - suspend2-userui <removed> (old-version)
1183    
1184    expat
1185            - w3c-libwww <removed> (embed; bug #551941)
1186            [etch] - w3c-libwww <unfixed> (embed; bug #551941) [./modules/expat/*]
1187            - python-xml <unfixed> (embed; bug #551940) [./extensions/expat/*]
1188            - python2.5 <unfixable> (embed; bug #553403) [./Modules/expat/*]
1189            - python2.4 <unfixable> (embed; bug #553403)
1190            - python2.7 2.7-6 (embed)
1191            - python-4suite <unfixed> (embed; bug #516935)
1192            - wxwindows2.4 <removed> (embed)
1193            - wxwidgets2.6 2.6.3.2.2-4 (embed)
1194            - wxwidgets2.8 2.8.10.1-2 (embed)
1195            - albert <unfixed> (embed; bug #600974)
1196            - celementtree 1.0.5-8 (embed)
1197            NOTE: Maybe that was fixed even earlier
1198            - centerim <unfixed> (embed; bug #559783)
1199            - audacity 1.3.2-1 (embed)
1200            - matanza <unfixed> (embed)
1201            - tdom 0.8.3~20080525-1 (embed)
1202            - udunits 2.1.8-4 (embed)
1203            - apr-util 1.2 (embed)
1204            - ayttm <unfxed> (embed; bug #561006)
1205            - cableswig <unfixed> (embed)
1206            - cadaver <unfixed> (embed)
1207            - cmake 2.6.0-6 (embed)
1208            - coin3 <unfixed> (embed)
1209            - cvsnt <unknown> (embed)
1210            - dasher <unknown> (embed)
1211            - gdcm 2.0.14-2 (embed)
1212            - ghostscript 8.71~dfsg-2 (embed)
1213            - grmonitor <removed> (embed)
1214            - iceape <unfixed> (embed)
1215            - insighttoolkit 3.16.0-1 (embed)
1216            NOTE: insighttoolkit might've been fixed earlier
1217            - jabber <unknown> (embed)
1218            - libparagui1.1 1.0.2-1 (embed)
1219            - libspiff <unknown> (embed)
1220            - mcabber <unfixed> (embed; bug #601053)
1221            - paraview 3.6.2-1 (embed)
1222            - poco 1.3.6p1-1 (embed)
1223            - scorched3d <unknown> (embed)
1224            - simgear <unfixed> (embed)
1225            - sitecopy 1:0.16.0-1
1226            - smart <unfixed> (embed)
1227            NOTE: smart embeds celementree, and it includes expat
1228            - swish-e <not-affected> (Linked against libxml, which is used instead)
1229            - tla 1.3.5+dfsg-15 (embed)
1230            - vtk 4.1.20030227-1 (embed)
1231            - wbxml2 <not-affected> (expat code is only used on Mac OS X, see #560941)
1232            - xmlrpc-c <unfixed> (embed)
1233            - iceweasel <unfixed> (embed)
1234            - kompozer <unfixed> (embed)
1235            - vxl 1.13.0-2 (embed)
1236            - xulrunner <unfixed> (embed)
1237            - xmame <unknown> (embed)
1238            - apache2 2.2 (embed)
1239            - texlive-bin <not-affected> (Embedded code not compiled in)
1240            - vnc4 <unfixed> (embed)
1241            - xotcl 1.6.6-1 (embed)
1242            - chromium-browser 5.0.375.29~r46008-3
1243    
1244    xerces-c
1245            - xerces-c2 <unfixed> (old-version)
1246            - xerces27 <removed> (old-version)
1247    
1248    md5 (RSA's version; not the gnu version provided by coreutils)
1249            - w3c-libwww <removed> (embed; bug #551942)
1250            [etch] - w3c-libwww <unfixed> (embed; bug #551942) [./modules/md5/*]
1251    
1252    libparagui1.1
1253            - asc <unfixable> (fork)
1254    
1255    enet
1256            - sauerbraten <unfixed> (embed; #497194)
1257    
1258    eglibc
1259            - glibc <removed> (old-version)
1260            - mksh <unfixable> (static)
1261              NOTE: /bin/mksh-static only, and only on some arches (others use dietlibc)
1262    
1263    galib
1264            - gamera 3.2.3-1 (embed)
1265    
1266    configobj
1267            - bzr 2.1.0~rc2-1 (embed; bug #555336)
1268            - elisa <unfixed> (embed; bug #555337)
1269            - gaupol <unfixed> (embed; bug #555338)
1270            - ipython <unfixed> (embed; bug #555339)
1271            - pida <unfixed> (embed; bug #555340)
1272            - psychopy <unfixed> (embed; bug #555341)
1273            - rest2web <unfixed> (embed; bug #555342)
1274            - auth2db <unknown> (embed)
1275            - dynagen <unknown> (embed)
1276            - iceweasel <unknown> (embed)
1277            - sabnzbdplus <unknown> (embed)
1278            - xulrunner <unknown> (embed)
1279            - nipy <not-affected> (part of an example [/examples/neurospin/neurospy/configobj.py], which is not installed into binary packages)
1280    
1281    python-clientform
1282            - bibus <unfixed> (embed; bug #555332)
1283            - zope2.10 <unfixed> (embed; bug #555333)
1284            - zope2.11 <removed> (embed; bug #555334)
1285            - python-mechanize <unknown> (embed)
1286            - twill <unknown> (embed)
1287    
1288    python-mechanize
1289            - zope2.10 <unfixed> (embed; bug #555337)
1290            - zope2.11 <removed> (embed; bug #555338)
1291            - twill <unknown> (embed; bug #555339)
1292    
1293    pexpect
1294            - duplicity 0.6.06-1 (embed; bug #555361)
1295            - hplip <unfixed> (embed; bug #555362)
1296            - smart <unfixed> (embed; bug #555363)
1297    
1298    pyparsing
1299            - bauble <unfixed> (embed; bug #555366)
1300            - boa-constructor 0.6.1-8 (embed; bug #555367)
1301            - calibre <unfixed> (embed; bug #555368)
1302            - matplotlib <unfixed> (embed; bug #531024)
1303            - zhpy 1.7.3.1-1 (embed; bug #555370)
1304            - polybori <unknown> (embed)
1305            - python-whoosh <unknown> (embed)
1306            - twill <unknown> (embed)
1307            - zope-textindexng3 <unknown> (embed)
1308    
1309    python-pysqlite2
1310            - python2.4 <unfixed> (embed; bug #553403)
1311            - python2.5 <unfixed> (embed; bug #553403)
1312    
1313    celementtree
1314            - python2.5 <unfixed> (embed)
1315            - smart <unfixed> (embed)
1316    
1317    elementtree
1318            - python2.5 <unfixed> (embed)
1319            - python2.6 <unfixed> (embed)
1320            - bzr 2.1.0~rc2-1 (embed; bug #555343)
1321            - gedit 2.28.2-1 (embed; bug #555344)
1322            - smart <unfixed> (embed)
1323            - solfege <unfixed> (embed; bug #555345)
1324            - w3af <unfixed> (embed; bug #555346)
1325            - python-qt4 <unknown> (embed)
1326            - sphinx <unknown> (embed)
1327            - python-nltk <itp> (embed)
1328    
1329    python2.5
1330            - python2.4 <unfixed> (old-version)
1331            - jython <unfixed> (embed)
1332            NOTE: embeds many stdlib modules
1333            - python-django <unfixed> (embed; bug #555419)
1334            NOTE: embeds stdlib modules: doctest, decimal
1335            - gamera 3.2.3-1 (embed)
1336            NOTE: embeds stdlib modules: ConfigParser, optparse, sets, textwrap
1337            - boa-constructor <unfixed> (embed; bug #555426)
1338            NOTE: embeds stdlib modules: ConfigParser, tarfile, zipfile, xmlrpclib
1339            - nicotine <unfixed> (embed; bug #555427)
1340            NOTE: embeds stdlib modules: ConfigParser
1341            - museek+ <unfixed> (embed; bug #555428)
1342            NOTE: embeds stdlib modules: ConfigParser
1343            - vegastrike-data <removed> (embed)
1344            NOTE: embeds many stdlib modules
1345            - codespeak-lib 1.1.1-1 (embed; bug #555420)
1346            NOTE: embeds stdlib modules: doctest, optparse, subprocess, textwrap
1347            - config-manager <unfixed> (embed; bug #555423)
1348            NOTE: embeds stdlib modules: optparse
1349            - jhbuild 2.28.0-1 (embed; bug #555421)
1350            NOTE: embeds stdlib modules: optparse, subprocess
1351            - smart <unfixed> (embed; bug #555432)
1352            NOTE: embeds stdlib modules: optparse
1353            - pyprotocols 1.0a.svn20070625-5 (embed; bug #555433)
1354            NOTE: embeds stdlib modules: doctest
1355            - ruledispatch 0.5a.svn20080510-4 (embed; bug #555434)
1356            NOTE: embeds stdlib modules: doctest
1357            - distribute <unfixed> (embed)
1358            NOTE: embeds stdlib modules: doctest
1359            - python-setuptools <unfixed> (embed; bug #555435)
1360            NOTE: embeds stdlib modules: doctest
1361            - zope.testing <unfixed> (embed; bug #555436)
1362            NOTE: embeds stdlib modules: doctest
1363            - translate-toolkit <unfixed> (embed; bug #555422)
1364            NOTE: embeds stdlib modules: textwrap, contextlib
1365            - libtpclient-py <unfixed> (embed; bug #555424)
1366            NOTE: embeds stdlib modules: subprocess
1367            - grass <unfixed> (embed; bug #555425)
1368            NOTE: embeds stdlib modules: subprocess
1369            - coherence <unfixed> (embed; bug #555429)
1370            NOTE: embeds stdlib modules: uuid
1371            - python-django-extensions 0.4.2pre+git200911182050-1 (embed; bug #555430)
1372            NOTE: embeds stdlib modules: uuid
1373            - setroubleshoot <removed> (embed; bug #555431)
1374            NOTE: embeds stdlib modules: uuid
1375            - linkchecker <unfixed> (embed; bug #555414)
1376            NOTE: embeds msgfmt.py script
1377            - imdbpy <unfixed> (embed)
1378            NOTE: embeds msgfmt.py script
1379            - kiwi <unfixed> (embed)
1380            NOTE: embeds msgfmt.py script
1381            - moin <unfixed> (embed)
1382            NOTE: embeds msgfmt.py script, stdlib modules: cgitb, difflib, tarfile
1383            - plone3 <removed> (embed)
1384            NOTE: embeds msgfmt.py script
1385            - roundup <unfixed> (embed)
1386            NOTE: embeds msgfmt.py script, stdlib modules: cgitb
1387            - rednotebook <unfixed> (embed; bug #555415)
1388            NOTE: embeds msgfmt.py script
1389            - turbogears <unfixed> (embed)
1390            NOTE: embeds msgfmt.py script
1391            - elisa <unfixed> (embed)
1392            NOTE: embeds msgfmt.py script, stdlib modules: uuid
1393            - calibre <unfixed> (embed)
1394            NOTE: embeds msgfmt.py script, stdlib modules: zipfile
1395            - mailman 1:2.1.13-1 (embed; #555416)
1396            NOTE: embeds msgfmt.py script
1397            - python-docutils <unknown> (embed)
1398            NOTE: embeds stdlib modules: optparse, textwrap
1399            - python-imaging <unknown> (embed)
1400            NOTE: embeds stdlib modules: doctest
1401            - python-mechanize <unknown> (embed)
1402            NOTE: embeds stdlib modules: doctest
1403            - twill <unknown> (embed)
1404            NOTE: embeds stdlib modules: subprocess
1405            - zeroc-ice <unknown> (embed)
1406            NOTE: embeds stdlib modules: subprocess
1407            - wxwidgets2.8 <unknown> (embed)
1408            NOTE: embeds stdlib modules: subprocess
1409            - cycle <unknown> (embed)
1410            NOTE: embeds msgfmt.py script
1411            - deluge <unknown> (embed)
1412            NOTE: embeds msgfmt.py script
1413            - opendict <unknown> (embed)
1414            NOTE: embeds msgfmt.py script
1415            - openerp-client <unknown> (embed)
1416            NOTE: embeds msgfmt.py script
1417            - rapidsvn <unknown> (embed)
1418            NOTE: embeds msgfmt.py script
1419            - wammu <unknown> (embed)
1420            NOTE: embeds msgfmt.py script
1421            - gaphor <unknown> (embed)
1422            NOTE: embeds msgfmt.py script
1423            - pida <unknown> (embed)
1424            NOTE: embeds msgfmt.py script
1425            - python-formencode <unknown> (embed)
1426            NOTE: embeds msgfmt.py script
1427            - duplicity <unfixed> (embed)
1428            NOTE: embeds stdlib module: urlparse, tarfile
1429            - pygopherd <unfixed> (embed)
1430            NOTE: embeds stdlib module: zipfile
1431    
1432    argparse
1433            - twill <unfixed> (embed; bug #555347)
1434            - ipython <unfixed> (embed; bug #555348)
1435    
1436    coherence
1437            - elisa <unfixed> (embed; bug #555335)
1438    
1439    simpletal
1440            - plastex <unfixed> (embed; bug #555371)
1441    
1442    flickrpc (not packaged in Debian, http://burtonini.com/bzr/flickrpc/)
1443            - postr <unfixed> (embed)
1444            - elisa <unfixed> (embed)
1445    
1446    simplegeneric (not packaged in Debian, http://pypi.python.org/pypi/simplegeneric)
1447            - apertium-tolk <unfixed> (embed)
1448            - ipython <unfixed> (embed)
1449            - virtaal <unfixed> (embed)
1450    
1451    distribute
1452            - setuptools <removed> (old-version)
1453    
1454    rails
1455            - jruby1.2 <removed> (embed) [./bench/rails/*]
1456            NOTE: jruby is in non-free, it probably includes rails too
1457            - libgettext-ruby <unfixed> (embed) [./samples/rails/*]
1458            - libopenid-ruby <unfixed> (embed) [./examples/rails_openid/*]
1459            - thin <unfixed> (embed) [./spec/rails_app/*]
1460            NOTE: this is a subdirectory of examples, which in general is a non-issue, but may
1461            NOTE: be dangerous if developers are naively basing their code off of the examples
1462            NOTE: prototype.js is among the example files
1463    
1464    lucene2 (prototype.js is among the embeds in the following)
1465            - lucene <unfixed> (old-version)
1466            - pylucene <unfixed> (embed)
1467            - libpdfbox-java <unfixed> (embed)
1468            - libfontbox-java <unfixed> (embed)
1469            - libjempbox-java <unfixed> (embed)
1470            - solr <unfixed> (embed)
1471    
1472    unicode-data
1473            - syslinux <unfixed> (embed)
1474            - camomile <unfixed> (embed)
1475            - fribidi <unfixed> (embed)
1476            - m17n-db <unfixed> (embed)
1477            - sbcl <unfixed> (embed)
1478            - heimdal <unfixed> (embed)
1479            - icu <unfixed> (embed)
1480            - icu4j <unfixed> (embed)
1481            - krb5 <unfixed> (embed)
1482            - moodle <unfixed> (embed)
1483            - openldap <unfixed> (embed)
1484            - pike7.6 <unfixed> (embed)
1485            - samba <unfixed> (embed)
1486            - samba4 <unfixed> (embed)
1487            - cmucl <unfixed> (embed)
1488            - typo3-src <unfixed> (embed)
1489            - mauve <unfixed> (embed)
1490            - texlive-bin <unfixed> (embed)
1491            - ypsilon <unfixed> (embed)
1492            - jeuclid <unfixed> (embed)
1493            - charmap.app <unfixed> (embed)
1494            - clisp <unfixed> (embed)
1495            - gnulib <unfixed> (embed)
1496            - opensrs-client <unfixed> (embed)
1497            - saxonb <unfixed> (embed)
1498            - rails <unfixed> (embed)
1499    
1500    feedparser
1501            - rawdog <unfixed> (embed; bug #383422)
1502            - miro <unfixed> (embed; bug #555351)
1503            - calibre <unfixed> (embed; bug #555352)
1504            - freevo <unfixed> (embed; bug #555353)
1505            - pida <unfixed> (embed; bug #555354)
1506            - planet-venus <unfixed> (embed; bug #555355)
1507            - plone3 <removed> (embed; bug #555356)
1508            - exaile 0.2.14+debian-1 (embed)
1509            - screenlets 0.1.2-3 (embed)
1510            NOTE: included twice
1511    
1512    agg:
1513            - matplotlib <unfixed> (embed: bug #377271)
1514            - contextfree <unfixed> (embed)
1515            NOTE: since 2.2-1 it links statically to system libagg, but still uses the embedded copy
1516            - exactimage <unfixed> (embed)
1517            - python-enable <unfixed> (embed)
1518            - mapnik 0.5.1-3 (embed)
1519            NOTE: links statically to agg, but shared library is not available (bug #377271)
1520    
1521    vtk
1522            - paraview <unfixable> (embed; bug #495426)
1523    
1524    txt2tags
1525            - rednotebook <unfixed> (embed)
1526    
1527    htmltextview (not packaged in Debian, http://www.gnome.org/~gjc/htmltextview.py)
1528            - gajim <unfixed> (embed)
1529            - emesene <unfixed> (embed)
1530            - convirt <unfixed> (embed)
1531            - pida <unfixed> (embed)
1532            - rednotebook <unfixed> (embed)
1533    
1534    horde3 (prototype.js is among the embeds in the following)
1535            - mnemo2 <unfixed> (embed)
1536            - nag2 <unfixed> (embed)
1537            - wordpress <unfixed> (embed)
1538            NOTE: Text_Diff (wp-includes/Text/Diff*)
1539    
1540    cimg
1541            - gmic <unfixed> (embed)
1542    
1543    mootools
1544            - kdenetwork <unfixed> (embed)
1545            - gallery <unfixed> (embed)
1546            - jspwiki <unfixed> (embed)
1547            - vdr-plugin-live <unfixed> (embed)
1548            - perl-doc-html <unfixed> (embed)
1549    
1550  halibut:  openldap
1551  nsis          - openldap2.3 <removed> (old-version)
1552    
1553  libghttp:  grub2
1554  hotway          - grub <unfixed> (old-version)
1555    
1556  libsndfile:  gnupginterface
1557  ardour          - duplicity <unfixed> (embed)
1558    
1559  glibmm2.4:  python-dateutil
1560  ardour          - awn-extras-applets <unfixed> (embed)
1561            - matplotlib <unknown> (embed)
1562    
1563    cups
1564            - cupsys <removed> (old-version)
1565    
1566    yui
1567            - bcfg2 <not-affected> (present in source but not included in any binary files)
1568            - serendipity 1.5.3-1 (embed; bug #557746)
1569            - moodle 1.8.2.dfsg-5 (embed)
1570            - jifty 0.91117-1 (embed; bug #557748)
1571            - webgui 7.7.26-1 (embed)
1572            - loggerhead 1.17-1 (embed)
1573            - otrs2 2.4.7+dfsg1-1 (embed; bug #592146)
1574    
1575    quake3 (vanilla source not packaged in debian)
1576            - openarena <unfixable> (fork)
1577    
1578    quake2 (vanilla source not packaged in debian)
1579            - alien-arena <unfixable> (fork)
1580            - warsow <unfixable> (fork)
1581    
1582    libtheora
1583            - iceweasel <not-affected> (uses xulrunner)
1584            - xulrunner <unfixed> (embed; bug #540959)
1585            [etch] - xulrunner <not-affected> (introduced in firefox 3.5)
1586            [lenny] - xulrunner <not-affected> (introduced in firefox 3.5)
1587            - iceape <unfixed> (embed; bug #559276)
1588            [etch] - iceape <not-affected> (introduced in iceape 2.0)
1589            [lenny] - iceape <not-affected> (introduced in iceape 2.0)
1590    
1591    dtoa
1592            - bfilter <unfixed> (embed)
1593            - cacao <removed> (embed)
1594            - cdrdao <unfixed> (embed)
1595            - classpath <unfixed> (embed)
1596            - freej <unfixed> (embed)
1597            - iceape <unfixed> (embed)
1598            - iceweasel <unfixed> (embed)
1599            - jscoverage <unfixed> (embed)
1600            - kde4libs <unfixed> (embed)
1601            - kdelibs <unfixed> (embed)
1602            - kompozer <unfixed> (embed)
1603            - libv8 <unfixed> (embed)
1604            - mono <unfixed> (embed)
1605            - newlib <unfixed> (embed)
1606            - nspr <unfixed> (embed)
1607            - php5 <unfixed> (embed)
1608            - polyml <unfixed> (embed)
1609            - qt4-x11 <unfixed> (embed)
1610            - rhino <unfixed> (embed)
1611            NOTE: code translated to Java
1612            - ruby1.8 <unfixed> (embed)
1613            - ruby1.9 <unfixed> (embed)
1614            - ruby1.9.1 <unfixed> (embed)
1615            - sdd <unfixed> (embed)
1616            - sfind <unfixed> (embed)
1617            - star <unfixed> (embed)
1618            - tinymux <unfixed> (embed)
1619            - virtualbox-ose <unfixed> (embed)
1620            - webkit <unfixed> (embed)
1621            - xulrunner <unfixed> (embed)
1622    
1623    ipc (not packaged in Debian; see http://mozdev.org/pipermail/enigmail/2009-November/011678.html)
1624            - firegpg <unfixed> (embed)
1625            - enigmail <unfixed> (embed)
1626    
1627    ptmalloc (not packaged in Debian)
1628            - crystalspace <unfixed> (embed)
1629            - qt4-x11 <unfixed> (embed)
1630    
1631    svgalib
1632            - usplash <unfixed> (embed)
1633    
1634    bogl
1635            - usplash <unfixed> (embed)
1636    
1637    taglist
1638            - usplash <unfixed> (embed)
1639    
1640    portaudio
1641            - audacity <unfixed> (embed; bug #323711)
1642    
1643    nyquist
1644            - audacity <unfixed> (embed)
1645            NOTE: embeds a forked nyquist with support for a shared library
1646    
1647  libgnomecanvasmm2.6:  vamp-plugin-sdk
1648  ardour          - audacity <unfixed> (embed)
1649    
1650  libsigc++-2.0:  wordpress
1651  ardour          - libwordpress-xmlrpc-perl <removed> (embed) [./xmlrpc.php]
1652            - wordpress-mu <removed> (fork)
1653    
1654  soundtouch:  php5
1655  ardour          - php4 <removed> (old-version)
1656    
1657  libmms:  classpath
1658  xine-lib          - libgnucrypto-java <removed> (embed; bug #559788)
 mimms  
1659    
1660  FCKeditor:  libtool
1661  knowledgeroot          - apr <unfixed> (static; bug #489625)
1662  moin          NOTE: ships copy of libtool in libapr1-dev; was 'embed' before 1.3.2-3
1663  karrigell          - arts <unfixed> (embed)
1664  gforge-plugins-extra          - bochs 2.4.2-1 (embed; bug #560884)
1665            - camserv <unfixed> (embed)
1666  Moodle contains lots of things:          - collectd 4.8.2-1 (embed)
1667  AdoDB          - courier-authlib 0.58-4 (embed)
1668  AdoDB-XML Schema          NOTE: The etch version of courier-authlib was the earliest version checked, might be fixed earlier
1669  ipatlas          - cvsnt 2.5.04.3236-1.2 (embed)
1670  PHPMailer          - dico <not-affected> (Uses the system copy of ltdl)
1671  Smarty          - freeradius 0.1+20010527-1 (embed)
1672  htmlArea          NOTE: Earliest reference I could find from the changelog is from 27 May 2001
1673  TinyMCE          - ggobi 2.1.9~20091212-1 (embed)
1674  bennu          - glame 2.0.1-4 (embed)
1675            NOTE: The etch version of glame was the earliest version checked, might be fixed earlier
1676            - gnash 0.8.7-2 (embed)
1677            - gnu-smalltalk <unfixed> (embed; bug #566777)
1678            - google-gadgets 0.10.5-0.3 (embed)
1679            NOTE: 0.10.5-0.3 was the earliest version checked, was fixed earlier
1680            - graphicsmagick 1.3.5-6 (embed)
1681            - graphviz 2.8-3 (embed)
1682            NOTE: The etch version of graphviz was the earliest version checked, might be fixed earlier
1683            - guile-1.6 1.6.8-7 (embed)
1684            - hamlib 1.2.11-1 (embed)
1685            - hercules 3.06-1.2 (embed)
1686            - jags 1.0.4-3 (embed; bug #560864)
1687            - kdelibs <unfixed> (embed)
1688            - libannodex <removed> (embed)
1689            - libextractor 0.5.23+dfsg-4 (embed)
1690            - libmcrypt <not-affected> (libtool source present but not included in any of the binary packages)
1691            - libtunepimp 0.5.3-7.3 (embed)
1692            - mp4h 1.3.1-4.1 (embed)
1693            - naim <removed> (embed)
1694            - parser-mysql <unfixed> (embed)
1695            - pinball 0.3.1-11 (embed)
1696            - redland <unfixed> (embed)
1697            - siproxd <unfixed> (embed)
1698            - ski <unfixed> (embed)
1699            - synfig 0.62.00-1 (embed)
1700            - unixodbc 2.2.4-5 (embed)
1701            - xmlsec1 <not-affected> (Doesn't enable dynamic loading of crypto modules)
1702            - clamav 0.95+dfsg-1 (embed)
1703            - imagemagick 6:6.2.3.1-1 (embed)
1704            - hypre 2.4.0b-5 (embed)
1705            - lam <unfixed> (embed)
1706            - openmpi <unfixable> (embed; bug #559386)
1707            - parser <unfixed> (embed)
1708            - pdsh 2.18-5 (embed; bug #560892)
1709            - sbnc 1.2-8 (embed)
1710            - sdcc <unfixed> (embed)
1711            - wml <not-affected> (The embedded ltdl isn't used, instead mp4h is used, see 559841)
1712            - proftpd-dfsg <unfixed> (embed; bug #561748)
1713            - babel 1.4.0.dfsg-5 (embed)
1714            - libprelude 0.9.14-2 (embed)
1715            - heartbeat 2.1.4-7 (embed)
1716            NOTE: From Squeeze onwards the system copy of ltdl is used, use the current version from Squeeze,
1717            NOTE: might've been fixed earlier
1718            - gcc-* <unknown> (embed)
1719    
1720    ocamlgsl
1721            - orpie 1.5.1-7.1 (embed; bug #550058)
1722    
1723    xdotool
1724            - keynav <unfixed> (embed; bug #560103)
1725    
1726    bulletphysics (not packaged; http://www.bulletphysics.org/)
1727            - supertuxkart <unfixed> (embed)
1728            - blender <unfixed> (embed)
1729    
1730  TinyMCE:  ghostscript
1731  wordpress          - gs-gpl <removed> (old-version)
 moodle  
 knowledgeroot  
 joomla (ITP)  
1732    
1733  scintilla:  icedove
1734  scite          - thunderbird <removed> (old-version)
 qscintilla  
 qscintilla2  
 geany  
1735    
1736  libphp-adodb:  sizzlejs (not packaged in Debian, http://sizzlejs.com/)
1737  gallery2          - jquery <unfixed> (embed)
 phppgadmin  
 egroupware  
 phpwiki  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
1738    
1739  gzip:  sed
1740  linux-kernel (lib/inflate.c)          - ssed <unfixed> (fork)
 klibc (based on linux-kernel gzip code)  
 busybox  
1741    
1742  neon:  phpatomlib (http://code.google.com/p/phpatomlib)
1743  cadaver (all, but being worked on: #188381)          - wordpress <unfixed> (embed)
1744  gnome-vfs2 (#395874)  
1745  litmus (#395875)  Services_JSON (http://pear.php.net/package/Services_JSON)
1746  screem (sarge only)          - wordpress <unfixed> (embed)
1747  sitecopy (#395876)  
1748  tla (etch/sid only: #395877)  phpass (http://www.openwall.com/phpass/)
1749            - gallery2 <unfixed> (embed)
1750            - wordpress <unfixed> (embed)
1751            - typo3-src <unfixed> (modified-embed)
1752            NOTE: file refers to drupal, maybe there's a copy somewhere there
1753            NOTE: a copyright owner search didn't match anything
1754            - libauthen-passphrase-perl <unfixable> (fork)
1755            NOTE: perl implementation of phpass
1756    
1757    squirrelmail
1758            - wordpress <unfixed> (embed)
1759            NOTE: class-pop3.php
1760    
1761    ezSQL (http://www.woyano.com/jv/ezsql)
1762            - wordpress <unfixable> (fork)
1763            NOTE: wp-db.php
1764    
1765    Diff.php (Clay Loveless' version/killersoft.com)
1766            - php-versioncontrol-svn <unfixed>
1767    
1768    libm (provided by libc)
1769            - spring <unfixed> (embed)
1770            NOTE: embedded by embedded copy of streflop
1771            - aide <unfixed> (static)
1772            - busybox <unfixed> (static)
1773            - mindi-busybox <unfixed> (static)
1774            - qemu <unfixed> (static)
1775            NOTE: qemu-user-static
1776            - tuxonice-userui <unfixed> (static)
1777            - zsh <unfixed> (static)
1778            NOTE: zsh-static
1779            - tripwire <unfixed>
1780    
1781    streflop
1782            - spring <unfixed> (embed)
1783    
1784  libmodplug:  minizip
1785  gst-plugins-bad0.10          - spring <unfixed> (embed)
1786    
1787  libvncserver:  oscpack
1788  vino          - spring <unfixed> (embed)
1789    
1790  putty:  hpiutil2
1791  filezilla          - spring <unfixed> (embed)
1792    
1793  tinyxml (not packaged in Debian):  p7zip
1794  filezilla          - spring <unfixed> (embed)
1795    
1796  gv:  pythonqt (doesn't seem to be python-qtN, unknown source)
1797  evince (ps/ tree from gv 3.5.8)          - fontmatrix <unfixed> (embed)
1798  evince-gtk (not packaged in Debian)          - elmerfem <unfixed> (embed)
1799    
1800  libXbae:  iepngfix (not packaged in Debian; http://www.twinhelix.com/css/iepngfix/)
1801  libpawlib2-lesstif package (from Cernlib)          - docvert <unfixed> (embed)
1802            - jifty <unfixed> (embed)
1803            - kdenetwork <unfixed> (embed)
1804            - mediatomb <unfixed> (embed)
1805            - plastex <unfixed> (embed)
1806            - plone3 <removed> (embed)
1807            - python-chaco <unfixed> (embed)
1808            - python-docutils <unfixed> (embed)
1809            - s5 <unfixed> (embed)
1810            - zope2.10 <unfixed> (embed)
1811            - zope2.11 <removed> (embed)
1812            - cython <not-affcted> (embed)
1813            NOTE: part of documentation, which is not installed into the binary package
1814    
1815  libXaw:  python-docutils
1816  libpawlib2-lesstif package (from Cernlib)          - zope2.10 <unfixed> (embed)
1817            - zope2.11 <removed> (embed)
1818    
1819  (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  tesseract
1820            - ocropus <unfixed> (static)
1821    
1822  libgd2:  antlr
1823  graphviz (lib/gd seems to be 2.0.33)          - kdevelop <unfixed> (embed)
1824    
1825  rar:  libxerces2
1826  unrar-nonfree          - openjdk-6 <unfixed> (embed)
1827    
1828  unrar-free: (maybe this code is derived from the original rar, too?)  kfreebsd-8
1829  clamav (seems to be disabled in default config)          - kfreebsd-7 <unfixed> (old-version)
1830            - kfreebsd-6 <removed> (old-version)
1831    
1832  mplayer (DirectMedia Object loader):  ruby1.9.1
1833  xine-lib (src/libw32dll/)          - ruby1.9 <unfixed> (old-version)
1834  vlc (modules/codec/dmo/)          - ruby1.8 <unfixed> (old-version)
1835    
1836  libwpd (WordPerfect converter):  maildrop
1837  openoffice.org          - courier <unfixed> (embed) [./maildrop]
1838    
1839  fsplib (http://sourceforge.net/projects/fsp/):  glee
1840  gftp (lib/fsplib version 0.3)          - warzone2100 <not-affected> (embed)
1841    
1842  librpcsecgss:  phing
1843  krb5          - symfony <unfixed> (embed)
1844    
1845  jasper:  pake
1846  ghostscript          - symfony <unfixed> (embed)
 gs-gpl  
1847    
1848  libidn:  propel
1849  monotone          - symfony <unfixed> (embed)
1850    
1851  liblua:  creole
1852  monotone          - symfony <unfixed> (embed)
1853    
1854  libbotan:  hfsutils
1855  montone          - cdrkit <unfixed> (embed; bug #570187)
1856            NOTE: embeds hfsutils code in genisoimage
1857    
1858  NetXX:  cdrkit
1859  monotone          - grub2 <unfixed> (embed; bug #570156)
1860            NOTE: genisoimage imported into grub-mkisofs
1861    
1862  libgc:  kdebase-workspace
1863  mono          - kdebase <unfixed> (old-version)
1864    
1865  lzma:  file
1866  p7zip          - php5 <unfixable> (modified-embed)
1867            [lenny] - php5 <not-affected>
1868    
1869  lzo:  cdb
1870  grub2          - php5 <unfixed> (embed)
1871    
1872  pax code:  libmbfl (itp: #570708)
1873  tar          - php5 <unfixed> (embed)
1874  cpio          NOTE: PHP is actually the current upstream, ITP is of that code
1875    
1876    libonig
1877            - php5 5.3.2-1 (embed)
1878    
1879    xmlrpc-epi
1880            - php5 <unfixed> (embed)
1881    
1882    swt-gtk
1883            - eclipse <unfixed> (embed; bug #538808)
1884    
1885    txt2html
1886            - wml 2.0.11ds2-1 (embed)
1887    
1888    ca-certificates
1889            - nss <not-affected> (certificates are in source, but not included in any of the binary packages)
1890    
1891    openexr
1892            - freeimage <unfixed> (embed)
1893    
1894    libmng
1895            - freeimage <unfixed> (embed)
1896    
1897    openjpeg
1898            - freeimage <unfixed> (embed)
1899    
1900    libjpeg6b
1901            - freeimage <unfixed> (embed)
1902    
1903    libjpeg (don't know what exact version)
1904            - dcmtk <unfixed>
1905            - gdcm <unfixed>
1906            - insighttoolkit <unfixed>
1907            - openarena 0.8.5-5+exp1 (bug #495966)
1908            - outguess <unfixed>
1909            - squeak-vm <unfixed> (embed)
1910            - tremulous <unfixed>
1911            - tuxonice-userui <unfixed> (static)
1912            - fpc <unfixed> (static)
1913            - lazarus <unfixed> (static)
1914            NOTE: inherited from fpc, see #472304
1915            - mseide-msegui <unfixed> (static)
1916            NOTE: inherited from fpc, see #472304
1917            - easymp3gain <unfixed> (static)
1918            NOTE: inherited from fpc, see #472304
1919            - winff <unfixed> (static)
1920            NOTE: inherited from fpc, see #472304
1921            - texlive-bin <not-affected> (included in upstream source as dependency of libgd2, but not built or included in any of the binary packages)
1922    
1923    
1924    lxr
1925            - lxr-cvs <unfixed> (embed)
1926    
1927    libfile-copy-recursive-perl
1928            - r-base <unfixed> (embed; bug #577427)
1929            - r-base-core-ra <unfixed> (embed; bug #577429)
1930    
1931    delimmatch
1932            - r-base <unfixed> (embed; bug #577433)
1933            - r-base-core-ra <unfixed> (embed; bug #577434)
1934    
1935    libsmf (ITP: #572558)
1936            - denemo <unfixed> (embed)
1937            NOTE: http://lists.debian.org/debian-mentors/2010/04/msg00269.html
1938    
1939    libselinux
1940            - dpkg 1.15.6 (static)
1941    
1942    xinha (ITP: #479708)
1943            - horde3 <unfixed>
1944            - serendipity <unfixed>
1945            - openacs <unfixed>
1946            - dotlrn <unfixed>
1947    
1948    dvipng
1949            - texlive-bin <not-affected> (code present in source but not included in the binary packages)
1950    
1951    dvipdfmx
1952            - texlive-bin <unfixed> (embed)
1953            NOTE: this is intentionally part of the package now, and the separate dvipdfmx package has been removed from sid/squeeze
1954    
1955    lcdf-typetools
1956            - texlive-bin 2009-1 (embed)
1957    
1958    tex4ht
1959            - texlive-bin 2009-1 (embed)
1960    
1961    freetype
1962            - texlive-bin 2009-1 (embed)
1963    
1964    freetype2
1965            - texlive-bin 2009-1 (embed)
1966    
1967    silgraphite
1968            - texlive-bin <unfixed> (embed)
1969    
1970    unzip
1971            - texlive-bin 2009-1 (embed)
1972    
1973    jbig2dec
1974            - ghostscript 8.71~dfsg2-1 (embed)
1975    
1976    libxml2
1977            - chromium-browser 5.0.375.29~r46008-1
1978    
1979    protobuf
1980            - chromium-browser 5.0.375.70~r48679-2
1981    
1982    libv8
1983            - chromium-browser 5.0.375.38~r46659-1
1984    
1985    nspr
1986            - chromium-browser 5.0.375.29~r46008-3
1987    
1988    yasm
1989            - chromium-browser 5.0.375.29~r46008-2
1990    
1991    libxslt
1992            - chromium-browser 5.0.375.29~r46008-1
1993    
1994    miniupnpc (not packaged in Debian; ITP bug #444392)
1995            - warzone2100 <unfixed> (embed)
1996    
1997    iniparser (not packaged in Debian; RFP bug #582657)
1998            - warzone2100 <unfixed> (modified-embed)
1999    
2000    pyglet
2001            - sympy <unfixed> (embed; bug #459716)
2002    
2003    mpmath
2004            - sympy <unfixed> (embed; bug #541746)
2005    
2006    curl
2007            - cmake <unknown> (embed)
2008            - criticalmass <unfixed> (static; bug #599061)
2009            - wengophone 2.1.0~beta1-svn9983-1 (embed)
2010    
2011    lib3ds
2012            - boson <unfixed> (embed; bug #600900)
2013            - openscenegraph <unfixed> (embed; bug #601181)
2014    
2015    gaim
2016            - wengophone <unfixed> (embed; bug #601425)

Legend:
Removed from v.7214  
changed lines
  Added in v.15530

  ViewVC Help
Powered by ViewVC 1.1.5