/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 7683 by stef-guest, Sat Dec 22 13:03:01 2007 UTC revision 8438 by jamie-guest, Fri Mar 28 18:32:27 2008 UTC
# Line 1  Line 1 
1  This file collects cases, where a source package embeds code from  Embedded code copies
2  other projects, without linking dynamically:  ====================
3    
4  xpdf code: (some use xpdf 2, some xpdf 3)  This file collects source packages that embed code from other projects.
5  gpdf (has been replaced by evince - which uses poppler - in Etch)  This is considered bad for fixing security flaws because the fix needs
6  pdftohtml (has been replaced by poppler-utils from the poppler source package, still in Etch, though)  to be applied in multiple source packages.
7  kdegraphics/kpdf (okular, the kpdf replacement in KDE 4 is using poppler, #436164)  
8  tetex-bin (links to poppler since 3.0-12)  Format:
9  texlive-bin (links to poppler)  <srcpkg> (<optional comment about srcpkg>)
10  cupsys (uses xpdf-utils, it's still present in the src, though)          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11  poppler          NOTE: optional comments about the linkage of the embedding srcpkg
12  koffice/kword (upstream is working on using poppler, #436163)  
13  libextractor (uses internal pdf decoder since 0.5.12-1)  status: version number fixing the embedded copy, <unfixed>, <removed>,
14  pdfkit.framework (links to poppler since 0.8-4)          <itp> or <unknown> if the version number can not be determined
15  ipe (only small parts, but with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp)          <unfixable> for unavoidable cases (e.g., forks that add real value)
16  ruby-gnome2 (has a copy of poppler but links against the shared lib)  sort: static (linking statically against a lib)
17          embed (embedding a copy of the library into another source package)
18  silc-toolkit:        fork (the package is not just embedding code but it is a fork and
19  silc-client (uses libsilc and libsilcclient)              thus might share parts of the source code)
20          old-version (the package is an older version of essentially
21  dietlibc:                     the same code)
22  ccontrol (links statically)  
23    The srcpkg might be some string to identify the code if there is no
24  libiax:  specific source package.
25  iaxmodem  
26    Everything up to the next line is ignored.
27  zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  ---BEGIN
28  dpkg  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29  rsync (somehow derived code base)          NOTE: Fixed packages link to poppler library unless otherwise noted
30  mono          - gpdf <removed>
31  mozilla(?)          [sarge] - gpdf <unfixed>
32  Linux kernels          NOTE: has been replaced by evince in etch
33  pvpgn (links dynamically since 1.7.8-2)          - pdftohtml <unknown>
34  mrtg (links dynamically since 2.12.2-1)          [sarge] - pdftohtml <unfixed>
35  rpm          [etch] - pdftohtml <unfixed>
36            NOTE: has been replaced by poppler-utils
37  libbz2:          - kdegraphics <unfixed> (embed; bug #436164)
38  dpkg (statically linked)          NOTE: the kpdf replacement in KDE 4 is using poppler
39            - tetex-bin 3.0-12 (embed)
40  libgadu/ekg:          - texlive-bin 2007-1 (embed)
41  centericq          NOTE: links to poppler
42  gaim          - koffice <unfixed> (embed; bug #436163)
43  pigdin (links dynamically against libgadu)          - libextractor 0.5.12-1 (embed)
44  kopete (ships the code, but links dynamically in the Debian package)          NOTE: libextractor is using its own pdf decoder now
45  kadu (not packaged in Debian)          - libextractor 0.5.12-1 (embed)
46  GNU gadu (not yet packaged in Debian)          - pdfkit.framework 0.8-4 (embed)
47            - ipe <unfixed> (embed)
48  xmlrpc: (which package is the "origin" of this code?)          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
49  drupal          - ruby-gnome2 <unknown> (embed)
50  phpgroupware          NOTE: copy only present in source but links to poppler
51  egroupware  
52  phpwiki  ppmd
53  php4 (php-pear, IIRC this was reorganized some weeks ago?)          - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
54    
55  shtool: (affects build-time only)  peercast
56  mysql-ocaml          - gnome-peercast <unfixed> (embed)
57  php4          NOTE: gnome-peercast may better be removed, see #466539
58    
59  mozilla:  silc-toolkit
60  mozilla-firefox          - silc-client 1.1~beta6-1 (embed)
61  mozilla-thunderbird  
62  firefox (to be removed)  dietlibc
63  thunderbird (to be removed)          - ccontrol 0.9.1+20071204-1 (static)
64  iceweasel  
65  iceape  libiax
66  icedove          - iaxmodem <unfixed> (embed)
67  xulrunner  
68  nvu (no longer in Debian)  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
69            - dpkg <unfixed> (embed)
70  xli:          NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
71  xloadimage          - rsync <unfixed> (embed)
72            NOTE: somehow derived code base
73  lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)          - mono <unfixed> (embed)
74  openmotif          TODO: check mozilla
75  xfree86/xorg (in libxpm)          - Linux kernels <unfixed> (embed)
76            - pvpgn 1.7.8-2 (embed)
77  kerberized apps with BSD origin:          - mrtg 2.12.2-1 (embed)
78  krb4          - rpm <unknown> (embed)
79  krb5          NOTE: pinged anibal since when rpm was fixed
80  heimdal  
81    libbz2
82  grip: (which pkg is the origin?)          - dpkg <unfixed> (static)
83  libcdaudio  
84  grip  ekg
85  gnome-vfs (vfs2 as well?)          - centericq <unfixed> (embed)
86            - gaim <unfixed> (embed)
87  fudforum:          - pigdin <unfixed> (embed)(links dynamically against libgadu)
88  phpgroupware-fudforum          - kopete 4:3.3.2-5 (embed)
89  egroupware-fudforum (removed from egroupware after sarge)          - kadu <unfixed> (embed)
90            - gadu <unfixed> (embed)
91  cvs:          NOTE: g/kadu not packaged in Debian yet
92  gcvs (at least an additional script is included, check if there's more)  
93    xmlrpc (which package is the "origin" of this code?)
94  pcre:          - drupal <unfixed> (embed)
95  all pythons          - phpgroupware <unfixed> (embed)
96  php4 (src included, but Debian package links dynamically)          - egroupware <unfixed> (embed)
97  analog (src included, but Debian package links dynamically)          - phpwiki (embed)
98  libgoffice-1          - php4 <unfixed> (embed)
99  vfu (removed linking against embedded copy in 4.06-4.1; #450754)          TODO: check, php-pear, IIRC this was reorganized some weeks ago?
100  tf5 (since 5.0beta7 the Debian package links dynamically)  
101  monotone (including this starting from 0.37)  shtool (affects build-time only)
102  glib (2.14 series for gregex support, only for udeb, regular packag links dynamic)          - mysql-ocaml <unfixed> (embed)
103  apache2 (since 2.0.53-4 uses 040_link_external_pcre patch)          - php4 <unfixed> (embed)
104  exim4 (since 4.10-0.srh20.12 uses 36_pcre patch to use external pcre)  
105  yacas (<= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway)  mozilla source code
106  gtamsanalyzer.app (links dynamically since 0.42-5)          - mozilla-firefox <unfixed> (embed)
107            - mozilla-thunderbird
108  tiff:          - firefox <removed>
109  wxpythongtk (check, which debian pkg this is in)          [etch] - firefox <unfixed> (embed)
110  older kdegraphics/kpdf releases < 3.3 embedded a copy          - thunderbird <removed>
111            [etch] - thunderbird <unfixed> (embed)
112  uudeview:          - iceweasel <unfixed> (embed)
113  libconvert-uulib-perl          - iceape <unfixed> (embed)
114            - icedove <unfixed> (embed)
115  sqlite: (not affected by security vulnerabilities so far)          - xulrunner <unfixed> (embed)
116  amarok          - nvu <removed> (embed)
117  monotone  
118  iceweasel  xli
119            - xloadimage <unfixed> (embed)
120  util-linux/mount:  
121  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb  lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
122            - openmotif <unfixed> (embed)
123  webmin:          - xfree86/xorg <unfixed> (embed)
124  usermin (only in sarge)          NOTE: in libxpm
125    
126  sylpheed:  kerberized apps with BSD origin
127  sylpheed-claws          - krb4 <unfixed> (embed)
128            - krb5 <unfixed> (embed)
129  phpsysinfo:          - heimdal <unfixed> (embed)
130  egroupware  
131  phpgroupware  grip (which pkg is the origin?)
132            - libcdaudio
133  phpldapadmin:          - grip
134  egroupware (removed from egroupware after sarge)          - gnome-vfs
135            TODO: check vfs2 as well
136  chmlib:  
137  kchmviewer (ships the code but links dynamically)  fudforum
138            - phpgroupware-fudforum <unfixed> (embed)
139  libavcodec/libavformat (source: ffmpeg):          - egroupware-fudforum <removed>
140  mplayer (#395252)          [sarge] - egroupware-fudforum <unfixed> (embed)
141  xvidcap  
142  kino (links statically, does not include code)  cvs
143  vlc (links statically, does not include code)          - gcvs <unfixed> (embed)
144  smilutils (links statically, does not include code)          NOTE: see cvsunix/src in tarball
145  motion (links statically, does not include code)  
146  gst-ffmpeg  pcre
147  gstreamer0.10-ffmpeg          - python* <unfixed> (embed)
148  xmovie          - php4 <unknown> (embed)
149            - analog 2:5.23-0woody1 (embed)
150            - libgoffice-1 <unfixed> (embed)
151            - vfu 4.06-4.1 (embed; bug #450754)
152            - tf5 5.0beta7-1 (embed)
153            - monotone <unfixed> (embed)
154            NOTE: this only affects versions >= 0.37
155            - glib <unfixed> (embed)
156            NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic
157            - apache2 2.0.53-4 (embed)
158            - exim4 4.10-0.srh20.12 (embed)
159            - yacas <unfixed> (embed)
160            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
161            - gtamsanalyzer.app 0.42-5 (embed)
162            - tin <unknown> (embed)
163    
164    tiff
165            - wxpythongtk <unfixed> (embed)
166            TODO: check, which debian pkg this is in
167    
168    uudeview
169            - libconvert-uulib-perl <unfixed> (embed)
170    
171    sqlite (not affected by security vulnerabilities so far)
172            - amarok <unfixed> (embed)
173            - monotone <unfixed> (embed)
174            - iceweasel <unfixed> (embed)
175    
176    util-linux/mount
177            - loop-aes-utils <unfixed> (embed)
178            NOTE: contains code from util-linux' mount in the mount-aes-udeb
179    
180    webmin
181            - usermin <unknown> (embed)
182            [sarge] - usermin <unfixed> (embed)
183    
184    sylpheed
185            - sylpheed-claws <unfixed> (fork)
186    
187    phpsysinfo
188            - egroupware <unfixed> (embed)
189            - phpgroupware <unfixed> (embed)
190    
191    phpldapadmin
192            [sarge] - egroupware <unfixed> (embed)
193            NOTE: removed from egroupware after sarge
194    
195    chmlib
196            - kchmviewer <unknown> (embed)
197    
198    libavcodec/libavformat (source: ffmpeg)
199            - mplayer <unfixed> (embed; bug #395252)
200            - xvidcap <unfixed> (embed)
201            - kino <unfixed> (static)
202            - vlc <unfixed> (static)
203            - smilutils <unfixed> (static)
204            - motion <unfixed> (static)
205            - gst-ffmpeg <unfixed> (embed)
206            - gstreamer0.10-ffmpeg <unfixed> (embed)
207            - xmovie <unfixed>
208            TODO: gimp-gap (potentially using ffmpeg code as well)
209    
210    mad MPEG decoding lib
211            - mad <unfixed> (embed)
212            - xine-lib <unfixed> (embed)
213    
 mad MPEG decoding lib:  
 mad  
 xine-lib  
   
 libdts:  
214  libdts  libdts
215  xine-lib          - xine-lib <unfixed> (embed)
216    
 flac:  
217  flac  flac
218  xine-lib          - xine-lib <unfixed> (embed)
   
 liba52:  
 a52dec  
 xine-lib  
   
 libmpeg2:  
 mpeg2dec  
 xine-lib  
   
 curl:  
 wget (code for NTLM authentication)  
219    
220  TODO evaluate:  liba52
221  gimp-gap (potentially using ffmpeg code as well)          - a52dec <unfixed> (embed)
222            - xine-lib <unfixed> (embed)
223    
224  uw-imap:  libmpeg2
225  pine          - mpeg2dec <unfixed> (embed)
226  alpine          - xine-lib <unfixed> (embed)
227    
228  imagemagick:  curl
229  graphicsmagick          - wget <unfixed> (embed)
230            NOTE: code for NTLM authentication
231    
232  halibut:  uw-imap
233  nsis          - pine <unfixed> (embed)
234            - alpine <unfixed> (embed)
235    
236  libghttp:  imagemagick
237  hotway          - graphicsmagick <unfixed> (fork)
238    
239  libsndfile:  halibut
240  ardour          - nsis <unfixed> (embed)
241    
242  glibmm2.4:  libghttp
243  ardour          - hotway <unfixed> (embed)
244    
245  libgnomecanvasmm2.6:  libsndfile
246  ardour          - ardour <unfixed> (embed)
   
 libsigc++-2.0:  
 ardour  
   
 soundtouch:  
 ardour  
   
 libmms:  
 xine-lib  
 mimms  
   
 FCKeditor: (packaged as fckeditor)  
 knowledgeroot  
 moin (452599)  
 karrigell (452598)  
 gforge-plugins-extra (fixed since 4.6.99+svn6225-1)  
   
   
   
 Moodle contains lots of things:  
 AdoDB  
 AdoDB-XML Schema  
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
 TinyMCE  
 bennu  
247    
248  TinyMCE:  glibmm2.4
249  wordpress          - ardour <unfixed> (embed)
 moodle  
 knowledgeroot  
 joomla (ITP)  
250    
251  scintilla:  libgnomecanvasmm2.6
252  scite          - ardour <unfixed> (embed)
 qscintilla  
 qscintilla2  
 geany  
253    
254  libphp-adodb:  libsigc++-2.0
255  gallery2          - ardour <unfixed> (embed)
 phppgadmin  
 egroupware  
 phpwiki  
 ipplan  
 typo3  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
256    
257  gzip:  soundtouch
258  linux-kernel (lib/inflate.c)          - ardour <unfixed> (embed)
 klibc (based on linux-kernel gzip code)  
 busybox  
259    
260  neon:  libmms
261  cadaver (all, but being worked on: #188381)          - xine-lib <unfixed> (embed)
262  gnome-vfs2 (#395874)          - mimms <unfixed> (embed)
 litmus (#395875)  
 screem (sarge only)  
 sitecopy (#395876)  
 tla (etch/sid only: #395877)  
263    
264  libmodplug:  fckeditor
265  gst-plugins-bad0.10          - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
266            - moin <unfixed> (embed; bug #452599)
267            - karrigell <unfixed> (embed; bug #452598)
268            - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
269    
270  libvncserver:  ipatlas (not packaged in Debian)
271  vino          - moodle <unfixed> (embed)
272    
273  putty:  libphp-phpmailer
274  filezilla          - moodle <unfixed> (embed)
275    
276  tinyxml (not packaged in Debian):  htmlArea (not packaged in Debian)
277  filezilla          - moodle <unfixed> (embed)
278    
279  gv:  giflib:
280  evince (ps/ tree from gv 3.5.8)          - wine <unfixed> (embed; bug #466181)
 evince-gtk (not packaged in Debian)  
281    
282  libXbae:  bennu (not packaged in Debian)
283  libpawlib2-lesstif package (from Cernlib)          - moodle <unfixed> (embed)
284    
285  libXaw:  smarty:
286  libpawlib2-lesstif package (from Cernlib)          - moodle <unfixed> (embed; bug #471158)
287            - gallery2 <unfixed> (embed; bug #471160)
288            - mahara 0.9.2-2 (embed; bug #471201)
289            - gosa 2.4beta1-1 (embed; bug #471200)
290    
291  (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  TinyMCE
292            - wordpress <unfixed> (embed)
293  libgd2:          - moodle <unfixed> (embed)
294  graphviz (lib/gd seems to be 2.0.33)          - knowledgeroot <unfixed> (embed)
295            - joomla <itp> (bug #326398)
296  rar:  
297  unrar-nonfree  scintilla
298            - scite <unfixed> (embed)
299  unrar-free: (maybe this code is derived from the original rar, too?)          - qscintilla <unfixed> (embed)
300  clamav (seems to be disabled in default config)          - qscintilla2 <unfixed> (embed)
301            - geany <unfixed> (embed)
302  mplayer (DirectMedia Object loader):  
303  xine-lib (src/libw32dll/)  libphp-adodb
304  vlc (modules/codec/dmo/)          - moodle <unfixed> (embed)
305            NOTE: also AdoDB-XML Schema
306  libwpd (WordPerfect converter):          - gallery2 <unfixed> (embed)
307  openoffice.org          - phppgadmin <unfixed> (embed)
308            - egroupware <unfixed> (embed)
309  fsplib (http://sourceforge.net/projects/fsp/):          - phpwiki <unfixed> (embed)
310  gftp (lib/fsplib version 0.3)          - ipplan <unfixed> (embed)
311            - typo3 <unfixed> (embed)
312  librpcsecgss:          - moodle <unfixed> (embed)
313  krb5          - cacti <unknown> (embed)
314            [sarge] - cacti <unfixed> (embed)
315  jasper:          NOTE: dependency exists, but internal version is used
316  ghostscript  
317  gs-gpl  gzip
318            - linux-kernel <unfixed> (embed)
319  libidn:          NOTE: lib/inflate.c
320  monotone          - klibc <unfixed> (embed)
321            NOTE: based on linux-kernel gzip code
322  liblua:          - busybox <unfixed> (embed)
323  monotone  
324    neon
325  libbotan:          - cadaver <unfixed> (embed; bug #188381)
326  montone          - gnome-vfs2 <unfixed> (embed; bug #395874)
327            - litmus <unfixed> (embed; #395875)
328  NetXX:          [sarge] - screem <unfixed> (embed)
329  monotone          - sitecopy <unfixed> (embed; bug #395876)
330            [etch] - tla <unfixed> (embed; bug #395877)
331  libgc:          [sarge] - tla <unfixed> (embed; bug #395877)
332  mono  
333    libmodplug
334  lzma:          - gst-plugins-bad0.10 <unfixed> (embed)
335  p7zip  
336    libvncserver
337  lzo:          - vino <unfixed> (embed)
338  grub2  
339    putty
340            - filezilla <unfixed> (embed)
341    
342    tinyxml (not packaged in Debian)
343            - filezilla <unfixed>
344    
345    gv
346            - evince <unfixed> (embed)
347            NOTE: ps/ tree from gv 3.5.8
348            - evince-gtk <unfixed> (embed)
349            NOTE: not packaged in Debian
350    
351    libXbae
352            [etch] - libpawlib2-lesstif <unfixed> (embed)
353            NOTE: from Cernlib
354    
355    libXaw
356            [etch] - libpawlib2-lesstif
357            NOTE: from Cernlib
358            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
359    
360    libgd2
361            - graphviz <unfixed> (embed)
362            NOTE: lib/gd seems to be 2.0.33
363            - wml <unfixed> (embed)
364            NOTE: derived from gd 1.6.3
365    
366    rar
367            - unrar-nonfree <unfixed> (embed)
368    
369    unrar-free (maybe this code is derived from the original rar, too?)
370            - clamav <unfixed> (embed)
371            NOTE: seems to be disabled in default config
372    
373    mplayer (DirectMedia Object loader)
374            - xine-lib <unfixed> (embed)
375            NOTE: src/libw32dll/
376            - vlc <unfixed> (embed)
377            NOTE: modules/codec/dmo/
378    
379    libwpd (WordPerfect converter)
380            - openoffice.org <unfixed> (embed)
381    
382    fsplib (http://sourceforge.net/projects/fsp/)
383            - gftp <unfixed> (embed)
384            NOTE: lib/fsplib version 0.3
385    
386    librpcsecgss
387            - krb5 <unfixed> (embed)
388    
389    jasper
390            - ghostscript <unfixed> (embed)
391            - gs-gpl <unfixed> (embed)
392    
393    libidn
394            - monotone <unfixed> (embed)
395    
396    liblua
397            - monotone <unfixed> (embed)
398    
399    libbotan
400            - montone <unfixed> (embed)
401    
402    NetXX
403            - monotone <unfixed> (embed)
404    
405    libgc
406            - mono <unfixed> (embed)
407    
408    lzma
409            - p7zip <unfixed> (embed)
410    
411    lzo
412            - grub2 <unfixed> (embed)
413    
414    yassl
415            - mysql-dfsg-5.0 <unfixed> (embed)
416    
417    pax code
418            - tar <unfixed> (embed)
419            - cpio <unfixed> (embed)
420    
421    t1lib
422            - tetex-bin 2.0.2-1 (embed)
423            - texlive-bin <unknown> (embed)
424    
425    guichan
426            - boswars <unfixed> (embed)
427            NOTE: maintainer notified us, working on it
428    
429    tolua
430            - boswars <unfixed> (embed)
431            NOTE: maintainer notified us, working on it
432    
433    asio-dev
434            - luxrender <unfixed> (embed)
435            NOTE: maintainer notified us, working on it
436            NOTE: may be merged with boost "soon"
437    
438  pax code:  xine-lib
439  tar          - vlc <unfixed> (embed)
440  cpio          NOTE: only parts included in modules/access/rtsp
441    
442  t1lib:  netpbm
443  tetex-bin (links to system t1lib since 2.0.2)          - tcl8.3 <unfixed> (embed)
444  texlive-bin (links to system t1lib)          - tcl8.4 <unfixed> (embed)
445            - tcl8.5 <unfixed> (embed)
446            NOTE: generic/tkImgGIF.c
447    
448    tk8.5
449            - tk8.0 <removed> (old-version)
450            - tk8.3 <unfixed> (old-version)
451            - tk8.4 <unfixed> (old-version)
452            - perl-tk <unfixable> (fork)
453    
454    samba
455            - mc <unfixed> (embed)
456            NOTE: maintainer is aware of this, currently searching a solution
457    
458    plib1.8.4c2
459            - boson <unfixed> (fork)
460            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
461    
462    fribidi
463            - quesoglc <unfixed> (embed)
464    
465    glew
466            - quesoglc <unfixed> (embed)
467    
468    minorGems
469            - transcend <unfixed> (embed)
470            - cultivation <unfixed> (embed)
471    
472    libarchive
473            - tar <unfixed> (embed)
474            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
475            - cpio <unfixed> (embed)
476            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
477    

Legend:
Removed from v.7683  
changed lines
  Added in v.8438

  ViewVC Help
Powered by ViewVC 1.1.5