/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 4838 by neilm, Tue Oct 10 09:47:23 2006 UTC revision 8142 by fw, Tue Feb 12 20:19:50 2008 UTC
# Line 1  Line 1 
1    Embedded code copies
2    ====================
3    
4  This file collects cases, where a source package embeds code from  This file collects source packages that embed code from other projects.
5  other projects, without linking dynamically:  This is considered bad for fixing security flaws because the fix needs
6    to be applied in multiple source packages.
7    
8    Format:
9    <srcpkg> (<optional comment about srcpkg>)
10            - <embedding srcpkg> <status> (<sort>; bug #<number>)
11            NOTE: optional comments about the linkage of the embedding srcpkg
12    
13    status: version number fixing the embedded copy, <unfixed>, <removed>,
14            <itp> or <unknown> if the version number can not be determined
15            <unfixable> for unavoidable cases (e.g., forks that add real value)
16    sort: static (linking statically against a lib)
17          embed (embedding a copy of the library into another source package)
18          fork (the package is not just embedding code but it is a fork and
19                thus might share parts of the source code)
20          old-version (the package is an older version of essentially
21                       the same code)
22    
23    The srcpkg might be some string to identify the code if there is no
24    specific source package.
25    
26    Everything up to the next line is ignored.
27    ---BEGIN
28    xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29            NOTE: Fixed packages link to poppler library unless otherwise noted
30            - gpdf <removed>
31            [sarge] - gpdf <unfixed>
32            NOTE: has been replaced by evince in etch
33            - pdftohtml <unknown>
34            [sarge] - pdftohtml <unfixed>
35            [etch] - pdftohtml <unfixed>
36            NOTE: has been replaced by poppler-utils
37            - kdegraphics <unfixed> (embed; bug #436164)
38            NOTE: the kpdf replacement in KDE 4 is using poppler
39            - tetex-bin 3.0-12 (embed)
40            - texlive-bin 2007-1 (embed)
41            NOTE: links to poppler
42            - koffice <unfixed> (embed; bug #436163)
43            - libextractor 0.5.12-1 (embed)
44            NOTE: libextractor is using its own pdf decoder now
45            - libextractor 0.5.12-1 (embed)
46            - pdfkit.framework 0.8-4 (embed)
47            - ipe <unfixed> (embed)
48            NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
49            - ruby-gnome2 <unknown> (embed)
50            NOTE: copy only present in source but links to poppler
51    
52    ppmd
53            - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
54    
55    silc-toolkit
56            - silc-client 1.1~beta6-1 (embed)
57    
58    dietlibc
59            - ccontrol 0.9.1+20071204-1 (static)
60    
61    libiax
62            - iaxmodem <unfixed> (embed)
63    
64    zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
65            - dpkg <unfixed> (embed)
66            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
67            - rsync <unfixed> (embed)
68            NOTE: somehow derived code base
69            - mono <unfixed> (embed)
70            TODO: check mozilla
71            - Linux kernels <unfixed> (embed)
72            - pvpgn 1.7.8-2 (embed)
73            - mrtg 2.12.2-1 (embed)
74            - rpm <unknown> (embed)
75            NOTE: pinged anibal since when rpm was fixed
76    
77    libbz2
78            - dpkg <unfixed> (static)
79    
80    ekg
81            - centericq <unfixed> (embed)
82            - gaim <unfixed> (embed)
83            - pigdin <unfixed> (embed)(links dynamically against libgadu)
84            - kopete 4:3.3.2-5 (embed)
85            - kadu <unfixed> (embed)
86            - gadu <unfixed> (embed)
87            NOTE: g/kadu not packaged in Debian yet
88    
89    xmlrpc (which package is the "origin" of this code?)
90            - drupal <unfixed> (embed)
91            - phpgroupware <unfixed> (embed)
92            - egroupware <unfixed> (embed)
93            - phpwiki (embed)
94            - php4 <unfixed> (embed)
95            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
96    
97    shtool (affects build-time only)
98            - mysql-ocaml <unfixed> (embed)
99            - php4 <unfixed> (embed)
100    
101    mozilla source code
102            - mozilla-firefox <unfixed> (embed)
103            - mozilla-thunderbird
104            - firefox <removed>
105            [etch] - firefox <unfixed> (embed)
106            - thunderbird <removed>
107            [etch] - thunderbird <unfixed> (embed)
108            - iceweasel <unfixed> (embed)
109            - iceape <unfixed> (embed)
110            - icedove <unfixed> (embed)
111            - xulrunner <unfixed> (embed)
112            - nvu <removed> (embed)
113    
114    xli
115            - xloadimage <unfixed> (embed)
116    
117    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
118            - openmotif <unfixed> (embed)
119            - xfree86/xorg <unfixed> (embed)
120            NOTE: in libxpm
121    
122    kerberized apps with BSD origin
123            - krb4 <unfixed> (embed)
124            - krb5 <unfixed> (embed)
125            - heimdal <unfixed> (embed)
126    
127    grip (which pkg is the origin?)
128            - libcdaudio
129            - grip
130            - gnome-vfs
131            TODO: check vfs2 as well
132    
133    fudforum
134            - phpgroupware-fudforum <unfixed> (embed)
135            - egroupware-fudforum <removed>
136            [sarge] - egroupware-fudforum <unfixed> (embed)
137    
138    cvs
139            - gcvs <unfixed> (embed)
140            NOTE: see cvsunix/src in tarball
141    
142    pcre
143            - python* <unfixed> (embed)
144            - php4 <unknown> (embed)
145            - analog 2:5.23-0woody1 (embed)
146            - libgoffice-1 <unfixed> (embed)
147            - vfu 4.06-4.1 (embed; bug #450754)
148            - tf5 5.0beta7-1 (embed)
149            - monotone <unfixed> (embed)
150            NOTE: this only affects versions >= 0.37
151            - glib <unfixed> (embed)
152            NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic
153            - apache2 2.0.53-4 (embed)
154            - exim4 4.10-0.srh20.12 (embed)
155            - yacas <unfixed> (embed)
156            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
157            - gtamsanalyzer.app 0.42-5 (embed)
158    
159    tiff
160            - wxpythongtk <unfixed> (embed)
161            TODO: check, which debian pkg this is in
162    
163    uudeview
164            - libconvert-uulib-perl <unfixed> (embed)
165    
166    sqlite (not affected by security vulnerabilities so far)
167            - amarok <unfixed> (embed)
168            - monotone <unfixed> (embed)
169            - iceweasel <unfixed> (embed)
170    
171    util-linux/mount
172            - loop-aes-utils <unfixed> (embed)
173            NOTE: contains code from util-linux' mount in the mount-aes-udeb
174    
175    webmin
176            - usermin <unknown> (embed)
177            [sarge] - usermin <unfixed> (embed)
178    
179    sylpheed
180            - sylpheed-claws <unfixed> (fork)
181    
182    phpsysinfo
183            - egroupware <unfixed> (embed)
184            - phpgroupware <unfixed> (embed)
185    
186    phpldapadmin
187            [sarge] - egroupware <unfixed> (embed)
188            NOTE: removed from egroupware after sarge
189    
190    chmlib
191            - kchmviewer <unknown> (embed)
192    
193    libavcodec/libavformat (source: ffmpeg)
194            - mplayer <unfixed> (embed; bug #395252)
195            - xvidcap <unfixed> (embed)
196            - kino <unfixed> (static)
197            - vlc <unfixed> (static)
198            - smilutils <unfixed> (static)
199            - motion <unfixed> (static)
200            - gst-ffmpeg <unfixed> (embed)
201            - gstreamer0.10-ffmpeg <unfixed> (embed)
202            - xmovie <unfixed>
203            TODO: gimp-gap (potentially using ffmpeg code as well)
204    
205    mad MPEG decoding lib
206            - mad <unfixed> (embed)
207            - xine-lib <unfixed> (embed)
208    
209  xpdf code: (some use xpdf 2, some xpdf 3)  libdts
210  gpdf (will be replaced by evince in Gnome 2.12)          - xine-lib <unfixed> (embed)
 pdftohtml (current poppler source package has a ported version, pinged maintainer)  
 kdegraphics/kpdf (upstream is working on using poppler, probably not in time for Etch)  
 tetex-bin (links to poppler since 3.0-12)  
 cupsys (only older releases, recent ones use xpdf-utils, it's still present in the src, though)  
 poppler  
 koffice (upstream is working on using poppler, probably not in time for Etch)  
 libextractor (uses internal pdf decoder since 0.5.12-1)  
 pdfkit.framework (links to poppler since 0.8-4)  
   
 zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  
 dpkg  
 rsync (somehow derived code base)  
 mozilla(?)  
 Linux kernels  
 pvpgn (links dynamically since 1.7.8-2)  
 mrtg (links dynamically since 2.12.2-1)  
   
 libgadu/ekg:  
 centericq  
 gaim  
 kopete (ships the code, but links dynamically in the Debian package)  
 kadu (not packaged in Debian)  
 GNU gadu (not yet packaged in Debian)  
   
   
 xmlrpc: (which package is the "origin" of this code?)  
 drupal  
 phpgroupware  
 egroupware  
 phpwiki  
 php4 (php-pear, IIRC this was reorganized some weeks ago?)  
 tikiwiki (not packaged in Debian)  
   
   
 shtool: (affects build-time only)  
 mysql-ocaml  
 php4  
   
   
 mozilla:  
 mozilla-firefox  
 mozilla-thunderbird  
 nvu  
   
   
 xli:  
 xloadimage  
   
   
 lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)  
 openmotif  
 xfree86/xorg (in libxpm)  
   
   
 kerberized apps with BSD origin:  
 krb4  
 krb5  
 heimdal  
   
   
 grip: (which pkg is the origin?)  
 libcdaudio  
 grip  
 gnome-vfs (vfs2 as well?)  
   
   
 fudforum:  
 phpgroupware-fudforum  
 egroupware-fudforum  
   
 cvs:  
 gcvs (at least an additional script is included, check if there's more)  
211    
212  pcre:  flac
213  all pythons          - xine-lib <unfixed> (embed)
 php4 (src included, but Debian package links dynamically)  
 analog (src included, but Debian package links dynamically)  
 libgoffice-1  
 tf5 (since 5.0beta7 the Debian package links dynamically)  
214    
215  tiff:  liba52
216  wxpythongtk (check, which debian pkg this is in)          - a52dec <unfixed> (embed)
217  older kdegraphics/kpdf releases < 3.3 embedded a copy          - xine-lib <unfixed> (embed)
218    
219    libmpeg2
220            - mpeg2dec <unfixed> (embed)
221            - xine-lib <unfixed> (embed)
222    
223  uudeview:  curl
224  libconvert-uulib-perl          - wget <unfixed> (embed)
225            NOTE: code for NTLM authentication
226    
227  sqlite: (not affected by security vulnerabilities so far)  uw-imap
228  amarok          - pine <unfixed> (embed)
229            - alpine <unfixed> (embed)
230    
231  util-linux/mount:  imagemagick
232  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb          - graphicsmagick <unfixed> (fork)
233    
234  webmin:  halibut
235  usermin          - nsis <unfixed> (embed)
236    
237  sylpheed:  libghttp
238  sylpheed-claws          - hotway <unfixed> (embed)
239    
240  phpsysinfo:  libsndfile
241  egroupware          - ardour <unfixed> (embed)
 phpgroupware  
242    
243  phpldapadmin:  glibmm2.4
244  egroupware          - ardour <unfixed> (embed)
245    
246  chmlib:  libgnomecanvasmm2.6
247  kchmviewer (not packaged in Debian)          - ardour <unfixed> (embed)
248    
249  libavcodec/libavformat:  libsigc++-2.0
250  ffmpeg          - ardour <unfixed> (embed)
 xine-lib  
 xvidcap (currently in NEW)  
 kino (links statically, does not include code)  
 vlc (links statically, does not include code)  
 smilutils (links statically, does not include code)  
 motion (links statically, does not include code)  
 gst-ffmpeg  
 xmovie (currently in NEW)  
 gst-ffmpeg  
251    
252  mad MPEG decoding lib:  soundtouch
253  mad          - ardour <unfixed> (embed)
 xine-lib  
254    
255  libdts:  libmms
256  libdts          - xine-lib <unfixed> (embed)
257  xine-lib          - mimms <unfixed> (embed)
258    
259  flac:  fckeditor
260  flac          - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
261  xine-lib          - moin <unfixed> (embed; bug #452599)
262            - karrigell <unfixed> (embed; bug #452598)
263            - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
264    
265  liba52:  ipatlas (not packaged in Debian)
266  a52dec          - moodle <unfixed> (embed)
 xine-lib  
267    
268  libmpeg2:  libphp-phpmailer
269  mpeg2dec          - moodle <unfixed> (embed)
 xine-lib  
270    
271  curl:  htmlArea (not packaged in Debian)
272  wget (code for NTLM authentication)          - moodle <unfixed> (embed)
273    
274  TODO evaluate:  bennu (not packaged in Debian)
275  gimp-gap (potentially using ffmpeg code as well)          - moodle <unfixed> (embed)
276    
277  uw-imap:  smarty:
278  pine          - moodle <unfixed> (embed)
279    
 imagemagick:  
 graphicsmagick  
   
 halibut:  
 nsis  
   
 libghttp:  
 hotway  
   
 etl-dev (will be renamed to libetl-dev soon):  
 synfig  
   
 libmms:  
 xine-lib  
 mimms  
   
 FCKeditor:  
 knowledgeroot  
   
 Moodle contains lots of things:  
 AdoDB  
 AdoDB-XML Schema  
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
280  TinyMCE  TinyMCE
281  bennu          - wordpress <unfixed> (embed)
282            - moodle <unfixed> (embed)
283            - knowledgeroot <unfixed> (embed)
284            - joomla <itp> (bug #326398)
285    
286    scintilla
287            - scite <unfixed> (embed)
288            - qscintilla <unfixed> (embed)
289            - qscintilla2 <unfixed> (embed)
290            - geany <unfixed> (embed)
291    
292    libphp-adodb
293            - moodle <unfixed> (embed)
294            NOTE: also AdoDB-XML Schema
295            - gallery2 <unfixed> (embed)
296            - phppgadmin <unfixed> (embed)
297            - egroupware <unfixed> (embed)
298            - phpwiki <unfixed> (embed)
299            - ipplan <unfixed> (embed)
300            - typo3 <unfixed> (embed)
301            - moodle <unfixed> (embed)
302            - cacti <unknown> (embed)
303            [sarge] - cacti <unfixed> (embed)
304            NOTE: dependency exists, but internal version is used
305    
306    gzip
307            - linux-kernel <unfixed> (embed)
308            NOTE: lib/inflate.c
309            - klibc <unfixed> (embed)
310            NOTE: based on linux-kernel gzip code
311            - busybox <unfixed> (embed)
312    
313    neon
314            - cadaver <unfixed> (embed; bug #188381)
315            - gnome-vfs2 <unfixed> (embed; bug #395874)
316            - litmus <unfixed> (embed; #395875)
317            [sarge] - screem <unfixed> (embed)
318            - sitecopy <unfixed> (embed; bug #395876)
319            [etch] - tla <unfixed> (embed; bug #395877)
320            [sarge] - tla <unfixed> (embed; bug #395877)
321    
322    libmodplug
323            - gst-plugins-bad0.10 <unfixed> (embed)
324    
325    libvncserver
326            - vino <unfixed> (embed)
327    
328    putty
329            - filezilla <unfixed> (embed)
330    
331    tinyxml (not packaged in Debian)
332            - filezilla <unfixed>
333    
334    gv
335            - evince <unfixed> (embed)
336            NOTE: ps/ tree from gv 3.5.8
337            - evince-gtk <unfixed> (embed)
338            NOTE: not packaged in Debian
339    
340    libXbae
341            [etch] - libpawlib2-lesstif <unfixed> (embed)
342            NOTE: from Cernlib
343    
344    libXaw
345            [etch] - libpawlib2-lesstif
346            NOTE: from Cernlib
347            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
348    
349    libgd2
350            - graphviz <unfixed> (embed)
351            NOTE: lib/gd seems to be 2.0.33
352            - wml <unfixed> (embed)
353            NOTE: derived from gd 1.6.3
354    
355    rar
356            - unrar-nonfree <unfixed> (embed)
357    
358    unrar-free (maybe this code is derived from the original rar, too?)
359            - clamav <unfixed> (embed)
360            NOTE: seems to be disabled in default config
361    
362    mplayer (DirectMedia Object loader)
363            - xine-lib <unfixed> (embed)
364            NOTE: src/libw32dll/
365            - vlc <unfixed> (embed)
366            NOTE: modules/codec/dmo/
367    
368    libwpd (WordPerfect converter)
369            - openoffice.org <unfixed> (embed)
370    
371    fsplib (http://sourceforge.net/projects/fsp/)
372            - gftp <unfixed> (embed)
373            NOTE: lib/fsplib version 0.3
374    
375    librpcsecgss
376            - krb5 <unfixed> (embed)
377    
378    jasper
379            - ghostscript <unfixed> (embed)
380            - gs-gpl <unfixed> (embed)
381    
382    libidn
383            - monotone <unfixed> (embed)
384    
385    liblua
386            - monotone <unfixed> (embed)
387    
388    libbotan
389            - montone <unfixed> (embed)
390    
391    NetXX
392            - monotone <unfixed> (embed)
393    
394    libgc
395            - mono <unfixed> (embed)
396    
397    lzma
398            - p7zip <unfixed> (embed)
399    
400    lzo
401            - grub2 <unfixed> (embed)
402    
403    yassl
404            - mysql-dfsg-5.0 <unfixed> (embed)
405    
406    pax code
407            - tar <unfixed> (embed)
408            - cpio <unfixed> (embed)
409    
410    t1lib
411            - tetex-bin 2.0.2-1 (embed)
412            - texlive-bin <unknown> (embed)
413    
414    guichan
415            - boswars <unfixed> (embed)
416            NOTE: maintainer notified us, working on it
417    
418    tolua
419            - boswars <unfixed> (embed)
420            NOTE: maintainer notified us, working on it
421    
422    asio-dev
423            - luxrender <unfixed> (embed)
424            NOTE: maintainer notified us, working on it
425            NOTE: may be merged with boost "soon"
426    
427    xine-lib
428            - vlc <unfixed> (embed)
429            NOTE: only parts included in modules/access/rtsp
430    
431  TinyMCE:  netpbm
432  wordpress          - tcl8.3 <unfixed> (embed)
433  moodle          - tcl8.4 <unfixed> (embed)
434  knowledgeroot          - tcl8.5 <unfixed> (embed)
435  joomla (ITP)          NOTE: generic/tkImgGIF.c
   
 scintilla:  
 scite  
 qscintilla  
 geany  
   
 libphp-adodb:  
 gallery2  
 phppgadmin  
 egroupware  
 phpwiki  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
   
 gzip:  
 linux-kernel (lib/inflate.c)  
 klibc (based on linux-kernel gzip code)  
 busybox  
   

Legend:
Removed from v.4838  
changed lines
  Added in v.8142

  ViewVC Help
Powered by ViewVC 1.1.5