/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 7383 by jmm-guest, Fri Nov 23 22:34:12 2007 UTC revision 8438 by jamie-guest, Fri Mar 28 18:32:27 2008 UTC
# Line 1  Line 1 
1  This file collects cases, where a source package embeds code from  Embedded code copies
2  other projects, without linking dynamically:  ====================
3    
4  xpdf code: (some use xpdf 2, some xpdf 3)  This file collects source packages that embed code from other projects.
5  gpdf (has been replaced by evince - which uses poppler - in Etch)  This is considered bad for fixing security flaws because the fix needs
6  pdftohtml (has been replaced by poppler-utils from the poppler source package, still in Etch, though)  to be applied in multiple source packages.
7  kdegraphics/kpdf (okular, the kpdf replacement in KDE 4 is using poppler, #436164)  
8  tetex-bin (links to poppler since 3.0-12)  Format:
9  cupsys (uses xpdf-utils, it's still present in the src, though)  <srcpkg> (<optional comment about srcpkg>)
10  poppler          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11  koffice/kword (upstream is working on using poppler, #436163)          NOTE: optional comments about the linkage of the embedding srcpkg
12  libextractor (uses internal pdf decoder since 0.5.12-1)  
13  pdfkit.framework (links to poppler since 0.8-4)  status: version number fixing the embedded copy, <unfixed>, <removed>,
14  ipe (only small parts, but with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp)          <itp> or <unknown> if the version number can not be determined
15            <unfixable> for unavoidable cases (e.g., forks that add real value)
16  silc-toolkit:  sort: static (linking statically against a lib)
17  silc-client (uses libsilc and libsilcclient)        embed (embedding a copy of the library into another source package)
18          fork (the package is not just embedding code but it is a fork and
19  dietlibc:              thus might share parts of the source code)
20  ccontrol (links statically)        old-version (the package is an older version of essentially
21                       the same code)
22  libiax:  
23  iaxmodem  The srcpkg might be some string to identify the code if there is no
24    specific source package.
25  zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  
26  dpkg  Everything up to the next line is ignored.
27  rsync (somehow derived code base)  ---BEGIN
28  mono  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29  mozilla(?)          NOTE: Fixed packages link to poppler library unless otherwise noted
30  Linux kernels          - gpdf <removed>
31  pvpgn (links dynamically since 1.7.8-2)          [sarge] - gpdf <unfixed>
32  mrtg (links dynamically since 2.12.2-1)          NOTE: has been replaced by evince in etch
33  rpm          - pdftohtml <unknown>
34            [sarge] - pdftohtml <unfixed>
35  libbz2:          [etch] - pdftohtml <unfixed>
36  dpkg (statically linked)          NOTE: has been replaced by poppler-utils
37            - kdegraphics <unfixed> (embed; bug #436164)
38  libgadu/ekg:          NOTE: the kpdf replacement in KDE 4 is using poppler
39  centericq          - tetex-bin 3.0-12 (embed)
40  gaim          - texlive-bin 2007-1 (embed)
41  kopete (ships the code, but links dynamically in the Debian package)          NOTE: links to poppler
42  kadu (not packaged in Debian)          - koffice <unfixed> (embed; bug #436163)
43  GNU gadu (not yet packaged in Debian)          - libextractor 0.5.12-1 (embed)
44            NOTE: libextractor is using its own pdf decoder now
45  xmlrpc: (which package is the "origin" of this code?)          - libextractor 0.5.12-1 (embed)
46  drupal          - pdfkit.framework 0.8-4 (embed)
47  phpgroupware          - ipe <unfixed> (embed)
48  egroupware          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
49  phpwiki          - ruby-gnome2 <unknown> (embed)
50  php4 (php-pear, IIRC this was reorganized some weeks ago?)          NOTE: copy only present in source but links to poppler
51  tikiwiki  
52    ppmd
53  shtool: (affects build-time only)          - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
54  mysql-ocaml  
55  php4  peercast
56            - gnome-peercast <unfixed> (embed)
57  mozilla:          NOTE: gnome-peercast may better be removed, see #466539
58  mozilla-firefox  
59  mozilla-thunderbird  silc-toolkit
60  firefox (to be removed)          - silc-client 1.1~beta6-1 (embed)
61  thunderbird (to be removed)  
62  iceweasel  dietlibc
63  iceape          - ccontrol 0.9.1+20071204-1 (static)
64  icedove  
65  xulrunner  libiax
66  nvu (no longer in Debian)          - iaxmodem <unfixed> (embed)
67    
68  xli:  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
69  xloadimage          - dpkg <unfixed> (embed)
70            NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
71  lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)          - rsync <unfixed> (embed)
72  openmotif          NOTE: somehow derived code base
73  xfree86/xorg (in libxpm)          - mono <unfixed> (embed)
74            TODO: check mozilla
75  kerberized apps with BSD origin:          - Linux kernels <unfixed> (embed)
76  krb4          - pvpgn 1.7.8-2 (embed)
77  krb5          - mrtg 2.12.2-1 (embed)
78  heimdal          - rpm <unknown> (embed)
79            NOTE: pinged anibal since when rpm was fixed
80  grip: (which pkg is the origin?)  
81  libcdaudio  libbz2
82  grip          - dpkg <unfixed> (static)
83  gnome-vfs (vfs2 as well?)  
84    ekg
85  fudforum:          - centericq <unfixed> (embed)
86  phpgroupware-fudforum          - gaim <unfixed> (embed)
87  egroupware-fudforum (removed from egroupware after sarge)          - pigdin <unfixed> (embed)(links dynamically against libgadu)
88            - kopete 4:3.3.2-5 (embed)
89  cvs:          - kadu <unfixed> (embed)
90  gcvs (at least an additional script is included, check if there's more)          - gadu <unfixed> (embed)
91            NOTE: g/kadu not packaged in Debian yet
92  pcre:  
93  all pythons  xmlrpc (which package is the "origin" of this code?)
94  php4 (src included, but Debian package links dynamically)          - drupal <unfixed> (embed)
95  analog (src included, but Debian package links dynamically)          - phpgroupware <unfixed> (embed)
96  libgoffice-1          - egroupware <unfixed> (embed)
97  vfu (#450754)          - phpwiki (embed)
98  tf5 (since 5.0beta7 the Debian package links dynamically)          - php4 <unfixed> (embed)
99  monotone (including this starting from 0.37)          TODO: check, php-pear, IIRC this was reorganized some weeks ago?
100  glib (2.14 series for gregex support, only for udeb, regular packag links dynamic)  
101  apache2 (since 2.0.53-4 uses 040_link_external_pcre patch)  shtool (affects build-time only)
102  exim4 (since 4.10-0.srh20.12 uses 36_pcre patch to use external pcre)          - mysql-ocaml <unfixed> (embed)
103            - php4 <unfixed> (embed)
104  tiff:  
105  wxpythongtk (check, which debian pkg this is in)  mozilla source code
106  older kdegraphics/kpdf releases < 3.3 embedded a copy          - mozilla-firefox <unfixed> (embed)
107            - mozilla-thunderbird
108  uudeview:          - firefox <removed>
109  libconvert-uulib-perl          [etch] - firefox <unfixed> (embed)
110            - thunderbird <removed>
111  sqlite: (not affected by security vulnerabilities so far)          [etch] - thunderbird <unfixed> (embed)
112  amarok          - iceweasel <unfixed> (embed)
113  monotone          - iceape <unfixed> (embed)
114  iceweasel          - icedove <unfixed> (embed)
115            - xulrunner <unfixed> (embed)
116  util-linux/mount:          - nvu <removed> (embed)
117  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb  
118    xli
119  webmin:          - xloadimage <unfixed> (embed)
120  usermin (only in sarge)  
121    lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
122  sylpheed:          - openmotif <unfixed> (embed)
123  sylpheed-claws          - xfree86/xorg <unfixed> (embed)
124            NOTE: in libxpm
125  phpsysinfo:  
126  egroupware  kerberized apps with BSD origin
127  phpgroupware          - krb4 <unfixed> (embed)
128            - krb5 <unfixed> (embed)
129  phpldapadmin:          - heimdal <unfixed> (embed)
130  egroupware (removed from egroupware after sarge)  
131    grip (which pkg is the origin?)
132  chmlib:          - libcdaudio
133  kchmviewer (not packaged in Debian)          - grip
134            - gnome-vfs
135  libavcodec/libavformat (source: ffmpeg):          TODO: check vfs2 as well
136  mplayer (#395252)  
137  xvidcap  fudforum
138  kino (links statically, does not include code)          - phpgroupware-fudforum <unfixed> (embed)
139  vlc (links statically, does not include code)          - egroupware-fudforum <removed>
140  smilutils (links statically, does not include code)          [sarge] - egroupware-fudforum <unfixed> (embed)
141  motion (links statically, does not include code)  
142  gst-ffmpeg  cvs
143  gstreamer0.10-ffmpeg          - gcvs <unfixed> (embed)
144  xmovie          NOTE: see cvsunix/src in tarball
145    
146    pcre
147            - python* <unfixed> (embed)
148            - php4 <unknown> (embed)
149            - analog 2:5.23-0woody1 (embed)
150            - libgoffice-1 <unfixed> (embed)
151            - vfu 4.06-4.1 (embed; bug #450754)
152            - tf5 5.0beta7-1 (embed)
153            - monotone <unfixed> (embed)
154            NOTE: this only affects versions >= 0.37
155            - glib <unfixed> (embed)
156            NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic
157            - apache2 2.0.53-4 (embed)
158            - exim4 4.10-0.srh20.12 (embed)
159            - yacas <unfixed> (embed)
160            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
161            - gtamsanalyzer.app 0.42-5 (embed)
162            - tin <unknown> (embed)
163    
164    tiff
165            - wxpythongtk <unfixed> (embed)
166            TODO: check, which debian pkg this is in
167    
168    uudeview
169            - libconvert-uulib-perl <unfixed> (embed)
170    
171    sqlite (not affected by security vulnerabilities so far)
172            - amarok <unfixed> (embed)
173            - monotone <unfixed> (embed)
174            - iceweasel <unfixed> (embed)
175    
176    util-linux/mount
177            - loop-aes-utils <unfixed> (embed)
178            NOTE: contains code from util-linux' mount in the mount-aes-udeb
179    
180    webmin
181            - usermin <unknown> (embed)
182            [sarge] - usermin <unfixed> (embed)
183    
184    sylpheed
185            - sylpheed-claws <unfixed> (fork)
186    
187    phpsysinfo
188            - egroupware <unfixed> (embed)
189            - phpgroupware <unfixed> (embed)
190    
191    phpldapadmin
192            [sarge] - egroupware <unfixed> (embed)
193            NOTE: removed from egroupware after sarge
194    
195    chmlib
196            - kchmviewer <unknown> (embed)
197    
198    libavcodec/libavformat (source: ffmpeg)
199            - mplayer <unfixed> (embed; bug #395252)
200            - xvidcap <unfixed> (embed)
201            - kino <unfixed> (static)
202            - vlc <unfixed> (static)
203            - smilutils <unfixed> (static)
204            - motion <unfixed> (static)
205            - gst-ffmpeg <unfixed> (embed)
206            - gstreamer0.10-ffmpeg <unfixed> (embed)
207            - xmovie <unfixed>
208            TODO: gimp-gap (potentially using ffmpeg code as well)
209    
210    mad MPEG decoding lib
211            - mad <unfixed> (embed)
212            - xine-lib <unfixed> (embed)
213    
 mad MPEG decoding lib:  
 mad  
 xine-lib  
   
 libdts:  
214  libdts  libdts
215  xine-lib          - xine-lib <unfixed> (embed)
216    
 flac:  
217  flac  flac
218  xine-lib          - xine-lib <unfixed> (embed)
   
 liba52:  
 a52dec  
 xine-lib  
   
 libmpeg2:  
 mpeg2dec  
 xine-lib  
   
 curl:  
 wget (code for NTLM authentication)  
219    
220  TODO evaluate:  liba52
221  gimp-gap (potentially using ffmpeg code as well)          - a52dec <unfixed> (embed)
222            - xine-lib <unfixed> (embed)
223    
224  uw-imap:  libmpeg2
225  pine          - mpeg2dec <unfixed> (embed)
226  alpine          - xine-lib <unfixed> (embed)
227    
228  imagemagick:  curl
229  graphicsmagick          - wget <unfixed> (embed)
230            NOTE: code for NTLM authentication
231    
232  halibut:  uw-imap
233  nsis          - pine <unfixed> (embed)
234            - alpine <unfixed> (embed)
235    
236  libghttp:  imagemagick
237  hotway          - graphicsmagick <unfixed> (fork)
238    
239  libsndfile:  halibut
240  ardour          - nsis <unfixed> (embed)
241    
242  glibmm2.4:  libghttp
243  ardour          - hotway <unfixed> (embed)
244    
245  libgnomecanvasmm2.6:  libsndfile
246  ardour          - ardour <unfixed> (embed)
247    
248  libsigc++-2.0:  glibmm2.4
249  ardour          - ardour <unfixed> (embed)
   
 soundtouch:  
 ardour  
   
 libmms:  
 xine-lib  
 mimms  
   
 FCKeditor: (packaged as fckeditor)  
 knowledgeroot  
 moin (452599)  
 karrigell (452598)  
 gforge-plugins-extra (452597)  
   
   
   
 Moodle contains lots of things:  
 AdoDB  
 AdoDB-XML Schema  
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
 TinyMCE  
 bennu  
250    
251  TinyMCE:  libgnomecanvasmm2.6
252  wordpress          - ardour <unfixed> (embed)
 moodle  
 knowledgeroot  
 joomla (ITP)  
253    
254  scintilla:  libsigc++-2.0
255  scite          - ardour <unfixed> (embed)
 qscintilla  
 qscintilla2  
 geany  
256    
257  libphp-adodb:  soundtouch
258  gallery2          - ardour <unfixed> (embed)
 phppgadmin  
 egroupware  
 phpwiki  
 ipplan  
 typo3  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
259    
260  gzip:  libmms
261  linux-kernel (lib/inflate.c)          - xine-lib <unfixed> (embed)
262  klibc (based on linux-kernel gzip code)          - mimms <unfixed> (embed)
 busybox  
263    
264  neon:  fckeditor
265  cadaver (all, but being worked on: #188381)          - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
266  gnome-vfs2 (#395874)          - moin <unfixed> (embed; bug #452599)
267  litmus (#395875)          - karrigell <unfixed> (embed; bug #452598)
268  screem (sarge only)          - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
 sitecopy (#395876)  
 tla (etch/sid only: #395877)  
269    
270  libmodplug:  ipatlas (not packaged in Debian)
271  gst-plugins-bad0.10          - moodle <unfixed> (embed)
272    
273  libvncserver:  libphp-phpmailer
274  vino          - moodle <unfixed> (embed)
275    
276  putty:  htmlArea (not packaged in Debian)
277  filezilla          - moodle <unfixed> (embed)
278    
279  tinyxml (not packaged in Debian):  giflib:
280  filezilla          - wine <unfixed> (embed; bug #466181)
281    
282  gv:  bennu (not packaged in Debian)
283  evince (ps/ tree from gv 3.5.8)          - moodle <unfixed> (embed)
 evince-gtk (not packaged in Debian)  
284    
285  libXbae:  smarty:
286  libpawlib2-lesstif package (from Cernlib)          - moodle <unfixed> (embed; bug #471158)
287            - gallery2 <unfixed> (embed; bug #471160)
288            - mahara 0.9.2-2 (embed; bug #471201)
289            - gosa 2.4beta1-1 (embed; bug #471200)
290    
291  libXaw:  TinyMCE
292  libpawlib2-lesstif package (from Cernlib)          - wordpress <unfixed> (embed)
293            - moodle <unfixed> (embed)
294  (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)          - knowledgeroot <unfixed> (embed)
295            - joomla <itp> (bug #326398)
296  libgd2:  
297  graphviz (lib/gd seems to be 2.0.33)  scintilla
298            - scite <unfixed> (embed)
299  rar:          - qscintilla <unfixed> (embed)
300  unrar-nonfree          - qscintilla2 <unfixed> (embed)
301            - geany <unfixed> (embed)
302  unrar-free: (maybe this code is derived from the original rar, too?)  
303  clamav (seems to be disabled in default config)  libphp-adodb
304            - moodle <unfixed> (embed)
305  mplayer (DirectMedia Object loader):          NOTE: also AdoDB-XML Schema
306  xine-lib (src/libw32dll/)          - gallery2 <unfixed> (embed)
307  vlc (modules/codec/dmo/)          - phppgadmin <unfixed> (embed)
308            - egroupware <unfixed> (embed)
309  libwpd (WordPerfect converter):          - phpwiki <unfixed> (embed)
310  openoffice.org          - ipplan <unfixed> (embed)
311            - typo3 <unfixed> (embed)
312  fsplib (http://sourceforge.net/projects/fsp/):          - moodle <unfixed> (embed)
313  gftp (lib/fsplib version 0.3)          - cacti <unknown> (embed)
314            [sarge] - cacti <unfixed> (embed)
315  librpcsecgss:          NOTE: dependency exists, but internal version is used
316  krb5  
317    gzip
318  jasper:          - linux-kernel <unfixed> (embed)
319  ghostscript          NOTE: lib/inflate.c
320  gs-gpl          - klibc <unfixed> (embed)
321            NOTE: based on linux-kernel gzip code
322  libidn:          - busybox <unfixed> (embed)
323  monotone  
324    neon
325  liblua:          - cadaver <unfixed> (embed; bug #188381)
326  monotone          - gnome-vfs2 <unfixed> (embed; bug #395874)
327            - litmus <unfixed> (embed; #395875)
328  libbotan:          [sarge] - screem <unfixed> (embed)
329  montone          - sitecopy <unfixed> (embed; bug #395876)
330            [etch] - tla <unfixed> (embed; bug #395877)
331  NetXX:          [sarge] - tla <unfixed> (embed; bug #395877)
332  monotone  
333    libmodplug
334  libgc:          - gst-plugins-bad0.10 <unfixed> (embed)
335  mono  
336    libvncserver
337            - vino <unfixed> (embed)
338    
339    putty
340            - filezilla <unfixed> (embed)
341    
342    tinyxml (not packaged in Debian)
343            - filezilla <unfixed>
344    
345    gv
346            - evince <unfixed> (embed)
347            NOTE: ps/ tree from gv 3.5.8
348            - evince-gtk <unfixed> (embed)
349            NOTE: not packaged in Debian
350    
351    libXbae
352            [etch] - libpawlib2-lesstif <unfixed> (embed)
353            NOTE: from Cernlib
354    
355    libXaw
356            [etch] - libpawlib2-lesstif
357            NOTE: from Cernlib
358            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
359    
360    libgd2
361            - graphviz <unfixed> (embed)
362            NOTE: lib/gd seems to be 2.0.33
363            - wml <unfixed> (embed)
364            NOTE: derived from gd 1.6.3
365    
366    rar
367            - unrar-nonfree <unfixed> (embed)
368    
369    unrar-free (maybe this code is derived from the original rar, too?)
370            - clamav <unfixed> (embed)
371            NOTE: seems to be disabled in default config
372    
373    mplayer (DirectMedia Object loader)
374            - xine-lib <unfixed> (embed)
375            NOTE: src/libw32dll/
376            - vlc <unfixed> (embed)
377            NOTE: modules/codec/dmo/
378    
379    libwpd (WordPerfect converter)
380            - openoffice.org <unfixed> (embed)
381    
382    fsplib (http://sourceforge.net/projects/fsp/)
383            - gftp <unfixed> (embed)
384            NOTE: lib/fsplib version 0.3
385    
386    librpcsecgss
387            - krb5 <unfixed> (embed)
388    
389    jasper
390            - ghostscript <unfixed> (embed)
391            - gs-gpl <unfixed> (embed)
392    
393    libidn
394            - monotone <unfixed> (embed)
395    
396    liblua
397            - monotone <unfixed> (embed)
398    
399    libbotan
400            - montone <unfixed> (embed)
401    
402    NetXX
403            - monotone <unfixed> (embed)
404    
405    libgc
406            - mono <unfixed> (embed)
407    
408    lzma
409            - p7zip <unfixed> (embed)
410    
411    lzo
412            - grub2 <unfixed> (embed)
413    
414    yassl
415            - mysql-dfsg-5.0 <unfixed> (embed)
416    
417    pax code
418            - tar <unfixed> (embed)
419            - cpio <unfixed> (embed)
420    
421    t1lib
422            - tetex-bin 2.0.2-1 (embed)
423            - texlive-bin <unknown> (embed)
424    
425    guichan
426            - boswars <unfixed> (embed)
427            NOTE: maintainer notified us, working on it
428    
429    tolua
430            - boswars <unfixed> (embed)
431            NOTE: maintainer notified us, working on it
432    
433    asio-dev
434            - luxrender <unfixed> (embed)
435            NOTE: maintainer notified us, working on it
436            NOTE: may be merged with boost "soon"
437    
438  lzma:  xine-lib
439  p7zip          - vlc <unfixed> (embed)
440            NOTE: only parts included in modules/access/rtsp
441    
442  lzo:  netpbm
443  grub2          - tcl8.3 <unfixed> (embed)
444            - tcl8.4 <unfixed> (embed)
445            - tcl8.5 <unfixed> (embed)
446            NOTE: generic/tkImgGIF.c
447    
448    tk8.5
449            - tk8.0 <removed> (old-version)
450            - tk8.3 <unfixed> (old-version)
451            - tk8.4 <unfixed> (old-version)
452            - perl-tk <unfixable> (fork)
453    
454    samba
455            - mc <unfixed> (embed)
456            NOTE: maintainer is aware of this, currently searching a solution
457    
458    plib1.8.4c2
459            - boson <unfixed> (fork)
460            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
461    
462    fribidi
463            - quesoglc <unfixed> (embed)
464    
465    glew
466            - quesoglc <unfixed> (embed)
467    
468    minorGems
469            - transcend <unfixed> (embed)
470            - cultivation <unfixed> (embed)
471    
472    libarchive
473            - tar <unfixed> (embed)
474            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
475            - cpio <unfixed> (embed)
476            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
477    
 pax code:  
 tar  
 cpio  

Legend:
Removed from v.7383  
changed lines
  Added in v.8438

  ViewVC Help
Powered by ViewVC 1.1.5