/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 7791 by nion, Thu Jan 3 15:19:23 2008 UTC revision 8189 by thijs, Tue Feb 19 13:22:31 2008 UTC
# Line 1  Line 1 
1  Embedded code copies  Embedded code copies
2  ====================  ====================
3    
4  This file collects cases, where a source package embeds code from  This file collects source packages that embed code from other projects.
5  other projects which is considered bad for fixing security flaws  This is considered bad for fixing security flaws because the fix needs
6  because the fix needs to be applied in multiple source packages.  to be applied in multiple source packages.
7    
8  Format:  Format:
9  <srcpkg> (<optional comment about srcpkg>)  <srcpkg> (<optional comment about srcpkg>)
10          - <embedding srcpkg> <status> (<sort>; bug #<number>)          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11          NOTE: optional comments about the linkage of the embedding srcpkg          NOTE: optional comments about the linkage of the embedding srcpkg
12    
13  status: version number fixing the embedded copy, <unfixed>, <removed> or <unknown> if the version number can not be determined  status: version number fixing the embedded copy, <unfixed>, <removed>,
14  sort: static (linking statically against a lib), embed (embedding a copy of the library into another source package)          <itp> or <unknown> if the version number can not be determined
15  The srcpkg might be some string to identify the code if there is no specific source package.          <unfixable> for unavoidable cases (e.g., forks that add real value)
16    sort: static (linking statically against a lib)
17          embed (embedding a copy of the library into another source package)
18          fork (the package is not just embedding code but it is a fork and
19                thus might share parts of the source code)
20          old-version (the package is an older version of essentially
21                       the same code)
22    
23    The srcpkg might be some string to identify the code if there is no
24    specific source package.
25    
26    Everything up to the next line is ignored.
27    ---BEGIN
28  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29          NOTE: Fixed packages link to poppler library unless otherwise noted          NOTE: Fixed packages link to poppler library unless otherwise noted
30          - gpdf <removed>          - gpdf <removed>
# Line 41  xpdf (some srcpkgs use xpdf2 code, some Line 52  xpdf (some srcpkgs use xpdf2 code, some
52  ppmd  ppmd
53          - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)          - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
54    
55    peercast
56            - gnome-peercast <unfixed> (embed)
57            NOTE: gnome-peercast may better be removed, see #466539
58    
59  silc-toolkit  silc-toolkit
60          - silc-client 1.1~beta6-1 (embed)          - silc-client 1.1~beta6-1 (embed)
61    
# Line 61  zlib (lots of apps embed a copy, but lin Line 76  zlib (lots of apps embed a copy, but lin
76          - pvpgn 1.7.8-2 (embed)          - pvpgn 1.7.8-2 (embed)
77          - mrtg 2.12.2-1 (embed)          - mrtg 2.12.2-1 (embed)
78          - rpm <unknown> (embed)          - rpm <unknown> (embed)
79          NOTE: pinged joeyh since when rpm was fixed          NOTE: pinged anibal since when rpm was fixed
80    
81  libbz2  libbz2
82          - dpkg <unfixed> (static)          - dpkg <unfixed> (static)
# Line 103  mozilla source code Line 118  mozilla source code
118  xli  xli
119          - xloadimage <unfixed> (embed)          - xloadimage <unfixed> (embed)
120    
121  lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)  lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
122  openmotif          - openmotif <unfixed> (embed)
123  xfree86/xorg (in libxpm)          - xfree86/xorg <unfixed> (embed)
124            NOTE: in libxpm
125  kerberized apps with BSD origin:  
126  krb4  kerberized apps with BSD origin
127  krb5          - krb4 <unfixed> (embed)
128  heimdal          - krb5 <unfixed> (embed)
129            - heimdal <unfixed> (embed)
130  grip: (which pkg is the origin?)  
131  libcdaudio  grip (which pkg is the origin?)
132  grip          - libcdaudio
133  gnome-vfs (vfs2 as well?)          - grip
134            - gnome-vfs
135  fudforum:          TODO: check vfs2 as well
136  phpgroupware-fudforum  
137  egroupware-fudforum (removed from egroupware after sarge)  fudforum
138            - phpgroupware-fudforum <unfixed> (embed)
139  cvs:          - egroupware-fudforum <removed>
140  gcvs (at least an additional script is included, check if there's more)          [sarge] - egroupware-fudforum <unfixed> (embed)
141    
142  pcre:  cvs
143  all pythons          - gcvs <unfixed> (embed)
144  php4 (src included, but Debian package links dynamically)          NOTE: see cvsunix/src in tarball
145  analog (src included, but Debian package links dynamically)  
146  libgoffice-1  pcre
147  vfu (removed linking against embedded copy in 4.06-4.1; #450754)          - python* <unfixed> (embed)
148  tf5 (since 5.0beta7 the Debian package links dynamically)          - php4 <unknown> (embed)
149  monotone (including this starting from 0.37)          - analog 2:5.23-0woody1 (embed)
150  glib (2.14 series for gregex support, only for udeb, regular packag links dynamic)          - libgoffice-1 <unfixed> (embed)
151  apache2 (since 2.0.53-4 uses 040_link_external_pcre patch)          - vfu 4.06-4.1 (embed; bug #450754)
152  exim4 (since 4.10-0.srh20.12 uses 36_pcre patch to use external pcre)          - tf5 5.0beta7-1 (embed)
153  yacas (<= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway)          - monotone <unfixed> (embed)
154  gtamsanalyzer.app (links dynamically since 0.42-5)          NOTE: this only affects versions >= 0.37
155            - glib <unfixed> (embed)
156  tiff:          NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic
157  wxpythongtk (check, which debian pkg this is in)          - apache2 2.0.53-4 (embed)
158  older kdegraphics/kpdf releases < 3.3 embedded a copy          - exim4 4.10-0.srh20.12 (embed)
159            - yacas <unfixed> (embed)
160  uudeview:          NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
161  libconvert-uulib-perl          - gtamsanalyzer.app 0.42-5 (embed)
162    
163  sqlite: (not affected by security vulnerabilities so far)  tiff
164  amarok          - wxpythongtk <unfixed> (embed)
165  monotone          TODO: check, which debian pkg this is in
166  iceweasel  
167    uudeview
168  util-linux/mount:          - libconvert-uulib-perl <unfixed> (embed)
169  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb  
170    sqlite (not affected by security vulnerabilities so far)
171  webmin:          - amarok <unfixed> (embed)
172  usermin (only in sarge)          - monotone <unfixed> (embed)
173            - iceweasel <unfixed> (embed)
 sylpheed:  
 sylpheed-claws  
   
 phpsysinfo:  
 egroupware  
 phpgroupware  
   
 phpldapadmin:  
 egroupware (removed from egroupware after sarge)  
   
 chmlib:  
 kchmviewer (ships the code but links dynamically)  
   
 libavcodec/libavformat (source: ffmpeg):  
 mplayer (#395252)  
 xvidcap  
 kino (links statically, does not include code)  
 vlc (links statically, does not include code)  
 smilutils (links statically, does not include code)  
 motion (links statically, does not include code)  
 gst-ffmpeg  
 gstreamer0.10-ffmpeg  
 xmovie  
   
 mad MPEG decoding lib:  
 mad  
 xine-lib  
   
 libdts:  
 libdts  
 xine-lib  
   
 flac:  
 flac  
 xine-lib  
   
 liba52:  
 a52dec  
 xine-lib  
   
 libmpeg2:  
 mpeg2dec  
 xine-lib  
   
 curl:  
 wget (code for NTLM authentication)  
   
 TODO evaluate:  
 gimp-gap (potentially using ffmpeg code as well)  
   
 uw-imap:  
 pine  
 alpine  
   
 imagemagick:  
 graphicsmagick  
   
 halibut:  
 nsis  
   
 libghttp:  
 hotway  
   
 libsndfile:  
 ardour  
   
 glibmm2.4:  
 ardour  
   
 libgnomecanvasmm2.6:  
 ardour  
   
 libsigc++-2.0:  
 ardour  
   
 soundtouch:  
 ardour  
174    
175  libmms:  util-linux/mount
176  xine-lib          - loop-aes-utils <unfixed> (embed)
177  mimms          NOTE: contains code from util-linux' mount in the mount-aes-udeb
178    
179    webmin
180            - usermin <unknown> (embed)
181            [sarge] - usermin <unfixed> (embed)
182    
183  FCKeditor: (packaged as fckeditor)  sylpheed
184  knowledgeroot          - sylpheed-claws <unfixed> (fork)
 moin (452599)  
 karrigell (452598)  
 gforge-plugins-extra (fixed since 4.6.99+svn6225-1)  
185    
186    phpsysinfo
187            - egroupware <unfixed> (embed)
188            - phpgroupware <unfixed> (embed)
189    
190    phpldapadmin
191            [sarge] - egroupware <unfixed> (embed)
192            NOTE: removed from egroupware after sarge
193    
194    chmlib
195            - kchmviewer <unknown> (embed)
196    
197    libavcodec/libavformat (source: ffmpeg)
198            - mplayer <unfixed> (embed; bug #395252)
199            - xvidcap <unfixed> (embed)
200            - kino <unfixed> (static)
201            - vlc <unfixed> (static)
202            - smilutils <unfixed> (static)
203            - motion <unfixed> (static)
204            - gst-ffmpeg <unfixed> (embed)
205            - gstreamer0.10-ffmpeg <unfixed> (embed)
206            - xmovie <unfixed>
207            TODO: gimp-gap (potentially using ffmpeg code as well)
208    
209    mad MPEG decoding lib
210            - mad <unfixed> (embed)
211            - xine-lib <unfixed> (embed)
212    
213  Moodle contains lots of things:  libdts
214  AdoDB          - xine-lib <unfixed> (embed)
 AdoDB-XML Schema  
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
 TinyMCE  
 bennu  
215    
216  TinyMCE:  flac
217  wordpress          - xine-lib <unfixed> (embed)
 moodle  
 knowledgeroot  
 joomla (ITP)  
218    
219  scintilla:  liba52
220  scite          - a52dec <unfixed> (embed)
221  qscintilla          - xine-lib <unfixed> (embed)
 qscintilla2  
 geany  
222    
223  libphp-adodb:  libmpeg2
224  gallery2          - mpeg2dec <unfixed> (embed)
225  phppgadmin          - xine-lib <unfixed> (embed)
 egroupware  
 phpwiki  
 ipplan  
 typo3  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
226    
227  gzip:  curl
228  linux-kernel (lib/inflate.c)          - wget <unfixed> (embed)
229  klibc (based on linux-kernel gzip code)          NOTE: code for NTLM authentication
 busybox  
230    
231  neon:  uw-imap
232  cadaver (all, but being worked on: #188381)          - pine <unfixed> (embed)
233  gnome-vfs2 (#395874)          - alpine <unfixed> (embed)
 litmus (#395875)  
 screem (sarge only)  
 sitecopy (#395876)  
 tla (etch/sid only: #395877)  
234    
235  libmodplug:  imagemagick
236  gst-plugins-bad0.10          - graphicsmagick <unfixed> (fork)
237    
238  libvncserver:  halibut
239  vino          - nsis <unfixed> (embed)
240    
241  putty:  libghttp
242  filezilla          - hotway <unfixed> (embed)
243    
244  tinyxml (not packaged in Debian):  libsndfile
245  filezilla          - ardour <unfixed> (embed)
246    
247  gv:  glibmm2.4
248  evince (ps/ tree from gv 3.5.8)          - ardour <unfixed> (embed)
 evince-gtk (not packaged in Debian)  
249    
250  libXbae:  libgnomecanvasmm2.6
251  libpawlib2-lesstif package (from Cernlib)          - ardour <unfixed> (embed)
252    
253  libXaw:  libsigc++-2.0
254  libpawlib2-lesstif package (from Cernlib)          - ardour <unfixed> (embed)
255    
256  (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  soundtouch
257            - ardour <unfixed> (embed)
258    
259  libgd2:  libmms
260  graphviz (lib/gd seems to be 2.0.33)          - xine-lib <unfixed> (embed)
261            - mimms <unfixed> (embed)
262    
263  rar:  fckeditor
264  unrar-nonfree          - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
265            - moin <unfixed> (embed; bug #452599)
266            - karrigell <unfixed> (embed; bug #452598)
267            - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
268    
269  unrar-free: (maybe this code is derived from the original rar, too?)  ipatlas (not packaged in Debian)
270  clamav (seems to be disabled in default config)          - moodle <unfixed> (embed)
271    
272  mplayer (DirectMedia Object loader):  libphp-phpmailer
273  xine-lib (src/libw32dll/)          - moodle <unfixed> (embed)
 vlc (modules/codec/dmo/)  
274    
275  libwpd (WordPerfect converter):  htmlArea (not packaged in Debian)
276  openoffice.org          - moodle <unfixed> (embed)
277    
278  fsplib (http://sourceforge.net/projects/fsp/):  giflib:
279  gftp (lib/fsplib version 0.3)          - wine <unfixed> (embed; bug #466181)
280    
281  librpcsecgss:  bennu (not packaged in Debian)
282  krb5          - moodle <unfixed> (embed)
283    
284  jasper:  smarty:
285  ghostscript          - moodle <unfixed> (embed)
 gs-gpl  
286    
287  libidn:  TinyMCE
288  monotone          - wordpress <unfixed> (embed)
289            - moodle <unfixed> (embed)
290            - knowledgeroot <unfixed> (embed)
291            - joomla <itp> (bug #326398)
292    
293    scintilla
294            - scite <unfixed> (embed)
295            - qscintilla <unfixed> (embed)
296            - qscintilla2 <unfixed> (embed)
297            - geany <unfixed> (embed)
298    
299    libphp-adodb
300            - moodle <unfixed> (embed)
301            NOTE: also AdoDB-XML Schema
302            - gallery2 <unfixed> (embed)
303            - phppgadmin <unfixed> (embed)
304            - egroupware <unfixed> (embed)
305            - phpwiki <unfixed> (embed)
306            - ipplan <unfixed> (embed)
307            - typo3 <unfixed> (embed)
308            - moodle <unfixed> (embed)
309            - cacti <unknown> (embed)
310            [sarge] - cacti <unfixed> (embed)
311            NOTE: dependency exists, but internal version is used
312    
313    gzip
314            - linux-kernel <unfixed> (embed)
315            NOTE: lib/inflate.c
316            - klibc <unfixed> (embed)
317            NOTE: based on linux-kernel gzip code
318            - busybox <unfixed> (embed)
319    
320    neon
321            - cadaver <unfixed> (embed; bug #188381)
322            - gnome-vfs2 <unfixed> (embed; bug #395874)
323            - litmus <unfixed> (embed; #395875)
324            [sarge] - screem <unfixed> (embed)
325            - sitecopy <unfixed> (embed; bug #395876)
326            [etch] - tla <unfixed> (embed; bug #395877)
327            [sarge] - tla <unfixed> (embed; bug #395877)
328    
329    libmodplug
330            - gst-plugins-bad0.10 <unfixed> (embed)
331    
332    libvncserver
333            - vino <unfixed> (embed)
334    
335    putty
336            - filezilla <unfixed> (embed)
337    
338    tinyxml (not packaged in Debian)
339            - filezilla <unfixed>
340    
341    gv
342            - evince <unfixed> (embed)
343            NOTE: ps/ tree from gv 3.5.8
344            - evince-gtk <unfixed> (embed)
345            NOTE: not packaged in Debian
346    
347    libXbae
348            [etch] - libpawlib2-lesstif <unfixed> (embed)
349            NOTE: from Cernlib
350    
351    libXaw
352            [etch] - libpawlib2-lesstif
353            NOTE: from Cernlib
354            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
355    
356    libgd2
357            - graphviz <unfixed> (embed)
358            NOTE: lib/gd seems to be 2.0.33
359            - wml <unfixed> (embed)
360            NOTE: derived from gd 1.6.3
361    
362    rar
363            - unrar-nonfree <unfixed> (embed)
364    
365    unrar-free (maybe this code is derived from the original rar, too?)
366            - clamav <unfixed> (embed)
367            NOTE: seems to be disabled in default config
368    
369    mplayer (DirectMedia Object loader)
370            - xine-lib <unfixed> (embed)
371            NOTE: src/libw32dll/
372            - vlc <unfixed> (embed)
373            NOTE: modules/codec/dmo/
374    
375    libwpd (WordPerfect converter)
376            - openoffice.org <unfixed> (embed)
377    
378    fsplib (http://sourceforge.net/projects/fsp/)
379            - gftp <unfixed> (embed)
380            NOTE: lib/fsplib version 0.3
381    
382    librpcsecgss
383            - krb5 <unfixed> (embed)
384    
385    jasper
386            - ghostscript <unfixed> (embed)
387            - gs-gpl <unfixed> (embed)
388    
389    libidn
390            - monotone <unfixed> (embed)
391    
392    liblua
393            - monotone <unfixed> (embed)
394    
395  liblua:  libbotan
396  monotone          - montone <unfixed> (embed)
397    
398  libbotan:  NetXX
399  montone          - monotone <unfixed> (embed)
400    
401  NetXX:  libgc
402  monotone          - mono <unfixed> (embed)
403    
404  libgc:  lzma
405  mono          - p7zip <unfixed> (embed)
406    
407  lzma:  lzo
408  p7zip          - grub2 <unfixed> (embed)
409    
410  lzo:  yassl
411  grub2          - mysql-dfsg-5.0 <unfixed> (embed)
412    
413  pax code:  pax code
414  tar          - tar <unfixed> (embed)
415  cpio          - cpio <unfixed> (embed)
416    
417    t1lib
418            - tetex-bin 2.0.2-1 (embed)
419            - texlive-bin <unknown> (embed)
420    
421    guichan
422            - boswars <unfixed> (embed)
423            NOTE: maintainer notified us, working on it
424    
425    tolua
426            - boswars <unfixed> (embed)
427            NOTE: maintainer notified us, working on it
428    
429    asio-dev
430            - luxrender <unfixed> (embed)
431            NOTE: maintainer notified us, working on it
432            NOTE: may be merged with boost "soon"
433    
434  t1lib:  xine-lib
435  tetex-bin (links to system t1lib since 2.0.2)          - vlc <unfixed> (embed)
436  texlive-bin (links to system t1lib)          NOTE: only parts included in modules/access/rtsp
437    
438    netpbm
439            - tcl8.3 <unfixed> (embed)
440            - tcl8.4 <unfixed> (embed)
441            - tcl8.5 <unfixed> (embed)
442            NOTE: generic/tkImgGIF.c
443    
444    tk8.5
445            - tk8.0 <removed> (old-version)
446            - tk8.3 <unfixed> (old-version)
447            - tk8.4 <unfixed> (old-version)
448            - perl-tk <unfixable> (fork)

Legend:
Removed from v.7791  
changed lines
  Added in v.8189

  ViewVC Help
Powered by ViewVC 1.1.5