/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 4517 by stef-guest, Mon Aug 7 18:59:32 2006 UTC revision 8142 by fw, Tue Feb 12 20:19:50 2008 UTC
# Line 1  Line 1 
1    Embedded code copies
2    ====================
3    
4  This file collects cases, where a source package embeds code from  This file collects source packages that embed code from other projects.
5  other projects, without linking dynamically:  This is considered bad for fixing security flaws because the fix needs
6    to be applied in multiple source packages.
7    
8    Format:
9    <srcpkg> (<optional comment about srcpkg>)
10            - <embedding srcpkg> <status> (<sort>; bug #<number>)
11            NOTE: optional comments about the linkage of the embedding srcpkg
12    
13    status: version number fixing the embedded copy, <unfixed>, <removed>,
14            <itp> or <unknown> if the version number can not be determined
15            <unfixable> for unavoidable cases (e.g., forks that add real value)
16    sort: static (linking statically against a lib)
17          embed (embedding a copy of the library into another source package)
18          fork (the package is not just embedding code but it is a fork and
19                thus might share parts of the source code)
20          old-version (the package is an older version of essentially
21                       the same code)
22    
23    The srcpkg might be some string to identify the code if there is no
24    specific source package.
25    
26    Everything up to the next line is ignored.
27    ---BEGIN
28    xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29            NOTE: Fixed packages link to poppler library unless otherwise noted
30            - gpdf <removed>
31            [sarge] - gpdf <unfixed>
32            NOTE: has been replaced by evince in etch
33            - pdftohtml <unknown>
34            [sarge] - pdftohtml <unfixed>
35            [etch] - pdftohtml <unfixed>
36            NOTE: has been replaced by poppler-utils
37            - kdegraphics <unfixed> (embed; bug #436164)
38            NOTE: the kpdf replacement in KDE 4 is using poppler
39            - tetex-bin 3.0-12 (embed)
40            - texlive-bin 2007-1 (embed)
41            NOTE: links to poppler
42            - koffice <unfixed> (embed; bug #436163)
43            - libextractor 0.5.12-1 (embed)
44            NOTE: libextractor is using its own pdf decoder now
45            - libextractor 0.5.12-1 (embed)
46            - pdfkit.framework 0.8-4 (embed)
47            - ipe <unfixed> (embed)
48            NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
49            - ruby-gnome2 <unknown> (embed)
50            NOTE: copy only present in source but links to poppler
51    
52    ppmd
53            - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
54    
55    silc-toolkit
56            - silc-client 1.1~beta6-1 (embed)
57    
58    dietlibc
59            - ccontrol 0.9.1+20071204-1 (static)
60    
61    libiax
62            - iaxmodem <unfixed> (embed)
63    
64    zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
65            - dpkg <unfixed> (embed)
66            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
67            - rsync <unfixed> (embed)
68            NOTE: somehow derived code base
69            - mono <unfixed> (embed)
70            TODO: check mozilla
71            - Linux kernels <unfixed> (embed)
72            - pvpgn 1.7.8-2 (embed)
73            - mrtg 2.12.2-1 (embed)
74            - rpm <unknown> (embed)
75            NOTE: pinged anibal since when rpm was fixed
76    
77    libbz2
78            - dpkg <unfixed> (static)
79    
80    ekg
81            - centericq <unfixed> (embed)
82            - gaim <unfixed> (embed)
83            - pigdin <unfixed> (embed)(links dynamically against libgadu)
84            - kopete 4:3.3.2-5 (embed)
85            - kadu <unfixed> (embed)
86            - gadu <unfixed> (embed)
87            NOTE: g/kadu not packaged in Debian yet
88    
89    xmlrpc (which package is the "origin" of this code?)
90            - drupal <unfixed> (embed)
91            - phpgroupware <unfixed> (embed)
92            - egroupware <unfixed> (embed)
93            - phpwiki (embed)
94            - php4 <unfixed> (embed)
95            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
96    
97    shtool (affects build-time only)
98            - mysql-ocaml <unfixed> (embed)
99            - php4 <unfixed> (embed)
100    
101    mozilla source code
102            - mozilla-firefox <unfixed> (embed)
103            - mozilla-thunderbird
104            - firefox <removed>
105            [etch] - firefox <unfixed> (embed)
106            - thunderbird <removed>
107            [etch] - thunderbird <unfixed> (embed)
108            - iceweasel <unfixed> (embed)
109            - iceape <unfixed> (embed)
110            - icedove <unfixed> (embed)
111            - xulrunner <unfixed> (embed)
112            - nvu <removed> (embed)
113    
114    xli
115            - xloadimage <unfixed> (embed)
116    
117    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
118            - openmotif <unfixed> (embed)
119            - xfree86/xorg <unfixed> (embed)
120            NOTE: in libxpm
121    
122    kerberized apps with BSD origin
123            - krb4 <unfixed> (embed)
124            - krb5 <unfixed> (embed)
125            - heimdal <unfixed> (embed)
126    
127    grip (which pkg is the origin?)
128            - libcdaudio
129            - grip
130            - gnome-vfs
131            TODO: check vfs2 as well
132    
133    fudforum
134            - phpgroupware-fudforum <unfixed> (embed)
135            - egroupware-fudforum <removed>
136            [sarge] - egroupware-fudforum <unfixed> (embed)
137    
138    cvs
139            - gcvs <unfixed> (embed)
140            NOTE: see cvsunix/src in tarball
141    
142    pcre
143            - python* <unfixed> (embed)
144            - php4 <unknown> (embed)
145            - analog 2:5.23-0woody1 (embed)
146            - libgoffice-1 <unfixed> (embed)
147            - vfu 4.06-4.1 (embed; bug #450754)
148            - tf5 5.0beta7-1 (embed)
149            - monotone <unfixed> (embed)
150            NOTE: this only affects versions >= 0.37
151            - glib <unfixed> (embed)
152            NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic
153            - apache2 2.0.53-4 (embed)
154            - exim4 4.10-0.srh20.12 (embed)
155            - yacas <unfixed> (embed)
156            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
157            - gtamsanalyzer.app 0.42-5 (embed)
158    
159    tiff
160            - wxpythongtk <unfixed> (embed)
161            TODO: check, which debian pkg this is in
162    
163    uudeview
164            - libconvert-uulib-perl <unfixed> (embed)
165    
166    sqlite (not affected by security vulnerabilities so far)
167            - amarok <unfixed> (embed)
168            - monotone <unfixed> (embed)
169            - iceweasel <unfixed> (embed)
170    
171    util-linux/mount
172            - loop-aes-utils <unfixed> (embed)
173            NOTE: contains code from util-linux' mount in the mount-aes-udeb
174    
175    webmin
176            - usermin <unknown> (embed)
177            [sarge] - usermin <unfixed> (embed)
178    
179    sylpheed
180            - sylpheed-claws <unfixed> (fork)
181    
182    phpsysinfo
183            - egroupware <unfixed> (embed)
184            - phpgroupware <unfixed> (embed)
185    
186    phpldapadmin
187            [sarge] - egroupware <unfixed> (embed)
188            NOTE: removed from egroupware after sarge
189    
190    chmlib
191            - kchmviewer <unknown> (embed)
192    
193    libavcodec/libavformat (source: ffmpeg)
194            - mplayer <unfixed> (embed; bug #395252)
195            - xvidcap <unfixed> (embed)
196            - kino <unfixed> (static)
197            - vlc <unfixed> (static)
198            - smilutils <unfixed> (static)
199            - motion <unfixed> (static)
200            - gst-ffmpeg <unfixed> (embed)
201            - gstreamer0.10-ffmpeg <unfixed> (embed)
202            - xmovie <unfixed>
203            TODO: gimp-gap (potentially using ffmpeg code as well)
204    
205    mad MPEG decoding lib
206            - mad <unfixed> (embed)
207            - xine-lib <unfixed> (embed)
208    
 xpdf code: (some use xpdf 2, some xpdf 3)  
 gpdf (will be replaced by evince in Gnome 2.12)  
 pdftohtml (current poppler source package has a ported version, pinged maintainer)  
 kdegraphics/kpdf (upstream is working on using poppler, probably not in time for Etch)  
 tetex-bin (links to poppler since 3.0-12)  
 cupsys (only older releases, recent ones use xpdf-utils, it's still present in the src, though)  
 poppler  
 koffice (upstream is working on using poppler, probably not in time for Etch)  
 libextractor (uses internal pdf decoder since 0.5.12-1)  
 pdfkit.framework (links to poppler since 0.8-4)  
   
 zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  
 dpkg  
 rsync (somehow derived code base)  
 mozilla(?)  
 Linux kernels  
 pvpgn (links dynamically since 1.7.8-2)  
 mrtg (links dynamically since 2.12.2-1)  
   
 libgadu/ekg:  
 centericq  
 gaim  
 kopete (ships the code, but links dynamically in the Debian package)  
 kadu (not packaged in Debian)  
 GNU gadu (not yet packaged in Debian)  
   
   
 xmlrpc: (which package is the "origin" of this code?)  
 drupal  
 phpgroupware  
 egroupware  
 phpwiki  
 php4 (php-pear, IIRC this was reorganized some weeks ago?)  
 tikiwiki (not packaged in Debian)  
   
   
 shtool: (affects build-time only)  
 mysql-ocaml  
 php4  
   
   
 mozilla:  
 mozilla-firefox  
 mozilla-thunderbird  
 nvu  
   
   
 xli:  
 xloadimage  
   
   
 lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)  
 openmotif  
 xfree86/xorg (in libxpm)  
   
   
 kerberized apps with BSD origin:  
 krb4  
 krb5  
 heimdal  
   
   
 grip: (which pkg is the origin?)  
 libcdaudio  
 grip  
 gnome-vfs (vfs2 as well?)  
   
   
 fudforum:  
 phpgroupware-fudforum  
 egroupware-fudforum  
   
 cvs:  
 gcvs (at least an additional script is included, check if there's more)  
   
 pcre:  
 all pythons  
 php4 (src included, but Debian package links dynamically)  
 analog (src included, but Debian package links dynamically)  
 libgoffice-1  
 tf5 (since 5.0beta7 the Debian package links dynamically)  
   
 tiff:  
 wxpythongtk (check, which debian pkg this is in)  
 older kdegraphics/kpdf releases < 3.3 embedded a copy  
   
   
 uudeview:  
 libconvert-uulib-perl  
   
 sqlite: (not affected by security vulnerabilities so far)  
 amarok  
   
 util-linux/mount:  
 loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb  
   
 webmin:  
 usermin  
   
 sylpheed:  
 sylpheed-claws  
   
 phpsysinfo:  
 egroupware  
 phpgroupware  
   
 phpldapadmin:  
 egroupware  
   
 chmlib:  
 kchmviewer (not packaged in Debian)  
   
 libavcodec/libavformat:  
 ffmpeg  
 xine-lib  
 xvidcap (currently in NEW)  
 kino (links statically, does not include code)  
 vlc (links statically, does not include code)  
 smilutils (links statically, does not include code)  
 motion (links statically, does not include code)  
 gst-ffmpeg  
 xmovie (currently in NEW)  
 gst-ffmpeg  
   
 mad MPEG decoding lib:  
 mad  
 xine-lib  
   
 libdts:  
209  libdts  libdts
210  xine-lib          - xine-lib <unfixed> (embed)
211    
 flac:  
212  flac  flac
213  xine-lib          - xine-lib <unfixed> (embed)
214    
215  liba52:  liba52
216  a52dec          - a52dec <unfixed> (embed)
217  xine-lib          - xine-lib <unfixed> (embed)
218    
219    libmpeg2
220            - mpeg2dec <unfixed> (embed)
221            - xine-lib <unfixed> (embed)
222    
223    curl
224            - wget <unfixed> (embed)
225            NOTE: code for NTLM authentication
226    
227    uw-imap
228            - pine <unfixed> (embed)
229            - alpine <unfixed> (embed)
230    
231    imagemagick
232            - graphicsmagick <unfixed> (fork)
233    
234    halibut
235            - nsis <unfixed> (embed)
236    
237    libghttp
238            - hotway <unfixed> (embed)
239    
240    libsndfile
241            - ardour <unfixed> (embed)
242    
243    glibmm2.4
244            - ardour <unfixed> (embed)
245    
246    libgnomecanvasmm2.6
247            - ardour <unfixed> (embed)
248    
249    libsigc++-2.0
250            - ardour <unfixed> (embed)
251    
252    soundtouch
253            - ardour <unfixed> (embed)
254    
255    libmms
256            - xine-lib <unfixed> (embed)
257            - mimms <unfixed> (embed)
258    
259    fckeditor
260            - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
261            - moin <unfixed> (embed; bug #452599)
262            - karrigell <unfixed> (embed; bug #452598)
263            - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
264    
265    ipatlas (not packaged in Debian)
266            - moodle <unfixed> (embed)
267    
268    libphp-phpmailer
269            - moodle <unfixed> (embed)
270    
271    htmlArea (not packaged in Debian)
272            - moodle <unfixed> (embed)
273    
274    bennu (not packaged in Debian)
275            - moodle <unfixed> (embed)
276    
277    smarty:
278            - moodle <unfixed> (embed)
279    
280    TinyMCE
281            - wordpress <unfixed> (embed)
282            - moodle <unfixed> (embed)
283            - knowledgeroot <unfixed> (embed)
284            - joomla <itp> (bug #326398)
285    
286    scintilla
287            - scite <unfixed> (embed)
288            - qscintilla <unfixed> (embed)
289            - qscintilla2 <unfixed> (embed)
290            - geany <unfixed> (embed)
291    
292    libphp-adodb
293            - moodle <unfixed> (embed)
294            NOTE: also AdoDB-XML Schema
295            - gallery2 <unfixed> (embed)
296            - phppgadmin <unfixed> (embed)
297            - egroupware <unfixed> (embed)
298            - phpwiki <unfixed> (embed)
299            - ipplan <unfixed> (embed)
300            - typo3 <unfixed> (embed)
301            - moodle <unfixed> (embed)
302            - cacti <unknown> (embed)
303            [sarge] - cacti <unfixed> (embed)
304            NOTE: dependency exists, but internal version is used
305    
306    gzip
307            - linux-kernel <unfixed> (embed)
308            NOTE: lib/inflate.c
309            - klibc <unfixed> (embed)
310            NOTE: based on linux-kernel gzip code
311            - busybox <unfixed> (embed)
312    
313    neon
314            - cadaver <unfixed> (embed; bug #188381)
315            - gnome-vfs2 <unfixed> (embed; bug #395874)
316            - litmus <unfixed> (embed; #395875)
317            [sarge] - screem <unfixed> (embed)
318            - sitecopy <unfixed> (embed; bug #395876)
319            [etch] - tla <unfixed> (embed; bug #395877)
320            [sarge] - tla <unfixed> (embed; bug #395877)
321    
322    libmodplug
323            - gst-plugins-bad0.10 <unfixed> (embed)
324    
325    libvncserver
326            - vino <unfixed> (embed)
327    
328    putty
329            - filezilla <unfixed> (embed)
330    
331    tinyxml (not packaged in Debian)
332            - filezilla <unfixed>
333    
334    gv
335            - evince <unfixed> (embed)
336            NOTE: ps/ tree from gv 3.5.8
337            - evince-gtk <unfixed> (embed)
338            NOTE: not packaged in Debian
339    
340    libXbae
341            [etch] - libpawlib2-lesstif <unfixed> (embed)
342            NOTE: from Cernlib
343    
344    libXaw
345            [etch] - libpawlib2-lesstif
346            NOTE: from Cernlib
347            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
348    
349    libgd2
350            - graphviz <unfixed> (embed)
351            NOTE: lib/gd seems to be 2.0.33
352            - wml <unfixed> (embed)
353            NOTE: derived from gd 1.6.3
354    
355    rar
356            - unrar-nonfree <unfixed> (embed)
357    
358    unrar-free (maybe this code is derived from the original rar, too?)
359            - clamav <unfixed> (embed)
360            NOTE: seems to be disabled in default config
361    
362    mplayer (DirectMedia Object loader)
363            - xine-lib <unfixed> (embed)
364            NOTE: src/libw32dll/
365            - vlc <unfixed> (embed)
366            NOTE: modules/codec/dmo/
367    
368    libwpd (WordPerfect converter)
369            - openoffice.org <unfixed> (embed)
370    
371    fsplib (http://sourceforge.net/projects/fsp/)
372            - gftp <unfixed> (embed)
373            NOTE: lib/fsplib version 0.3
374    
375    librpcsecgss
376            - krb5 <unfixed> (embed)
377    
378    jasper
379            - ghostscript <unfixed> (embed)
380            - gs-gpl <unfixed> (embed)
381    
382    libidn
383            - monotone <unfixed> (embed)
384    
385    liblua
386            - monotone <unfixed> (embed)
387    
388    libbotan
389            - montone <unfixed> (embed)
390    
391    NetXX
392            - monotone <unfixed> (embed)
393    
394    libgc
395            - mono <unfixed> (embed)
396    
397    lzma
398            - p7zip <unfixed> (embed)
399    
400    lzo
401            - grub2 <unfixed> (embed)
402    
403    yassl
404            - mysql-dfsg-5.0 <unfixed> (embed)
405    
406    pax code
407            - tar <unfixed> (embed)
408            - cpio <unfixed> (embed)
409    
410    t1lib
411            - tetex-bin 2.0.2-1 (embed)
412            - texlive-bin <unknown> (embed)
413    
414    guichan
415            - boswars <unfixed> (embed)
416            NOTE: maintainer notified us, working on it
417    
418    tolua
419            - boswars <unfixed> (embed)
420            NOTE: maintainer notified us, working on it
421    
422    asio-dev
423            - luxrender <unfixed> (embed)
424            NOTE: maintainer notified us, working on it
425            NOTE: may be merged with boost "soon"
426    
 libmpeg2:  
 mpeg2dec  
427  xine-lib  xine-lib
428            - vlc <unfixed> (embed)
429            NOTE: only parts included in modules/access/rtsp
430    
431  curl:  netpbm
432  wget (code for NTLM authentication)          - tcl8.3 <unfixed> (embed)
433            - tcl8.4 <unfixed> (embed)
434  TODO evaluate:          - tcl8.5 <unfixed> (embed)
435  gimp-gap (potentially using ffmpeg code as well)          NOTE: generic/tkImgGIF.c
   
 uw-imap:  
 pine  
   
 imagemagick:  
 graphicsmagick  
   
 halibut:  
 nsis  
   
 libghttp:  
 hotway  
   
 etl-dev (will be renamed to libetl-dev soon):  
 synfig  
   
 libphp-adodb:  
 moodle  
 cacti (dependency exists, but internal version is used)  
   
 libmms:  
 xine-lib  
 mimms  
   
 FCKeditor:  
 knowledgeroot  
   
 TinyMCE:  
 wordpress  
 moodle  
 knowledgeroot  
 joomla (ITP)  
   

Legend:
Removed from v.4517  
changed lines
  Added in v.8142

  ViewVC Help
Powered by ViewVC 1.1.5