/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 7007 by keescook-guest, Thu Oct 18 18:55:18 2007 UTC revision 8587 by nion, Sun Apr 20 18:24:56 2008 UTC
# Line 1  Line 1 
1  This file collects cases, where a source package embeds code from  Embedded code copies
2  other projects, without linking dynamically:  ====================
3    
4  xpdf code: (some use xpdf 2, some xpdf 3)  This file collects source packages that embed code from other projects.
5  gpdf (has been replaced by evince - which uses poppler - in Etch)  This is considered bad for fixing security flaws because the fix needs
6  pdftohtml (has been replaced by poppler-utils from the poppler source package, still in Etch, though)  to be applied in multiple source packages.
7  kdegraphics/kpdf (okular, the kpdf replacement in KDE 4 is using poppler, #436164)  
8  tetex-bin (links to poppler since 3.0-12)  Format:
9  cupsys (uses xpdf-utils, it's still present in the src, though)  <srcpkg> (<optional comment about srcpkg>)
10  poppler          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11  koffice/kword (upstream is working on using poppler, #436163)          NOTE: optional comments about the linkage of the embedding srcpkg
12  libextractor (uses internal pdf decoder since 0.5.12-1)  
13  pdfkit.framework (links to poppler since 0.8-4)  status: version number fixing the embedded copy, <unfixed>, <removed>,
14  ipe (only small parts, but with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp)          <itp> or <unknown> if the version number can not be determined
15            <unfixable> for unavoidable cases (e.g., forks that add real value)
16  silc-toolkit:  sort: static (linking statically against a lib)
17  silc-client (uses libsilc and libsilcclient)        embed (embedding a copy of the library into another source package)
18          fork (the package is not just embedding code but it is a fork and
19  dietlibc:              thus might share parts of the source code)
20  ccontrol (links statically)        old-version (the package is an older version of essentially
21                       the same code)
22  libiax:  
23  iaxmodem  The srcpkg might be some string to identify the code if there is no
24    specific source package.
25  zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  
26  dpkg  Everything up to the next line is ignored.
27  rsync (somehow derived code base)  ---BEGIN
28  mozilla(?)  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29  Linux kernels          NOTE: Fixed packages link to poppler library unless otherwise noted
30  pvpgn (links dynamically since 1.7.8-2)          - gpdf <removed>
31  mrtg (links dynamically since 2.12.2-1)          [sarge] - gpdf <unfixed>
32  rpm          NOTE: has been replaced by evince in etch
33            - pdftohtml <unknown>
34  libbz2:          [sarge] - pdftohtml <unfixed>
35  dpkg (statically linked)          [etch] - pdftohtml <unfixed>
36            NOTE: has been replaced by poppler-utils
37  libgadu/ekg:          - kdegraphics <unfixed> (embed; bug #436164)
38  centericq          NOTE: the kpdf replacement in KDE 4 is using poppler
39  gaim          - tetex-bin 3.0-12 (embed)
40  kopete (ships the code, but links dynamically in the Debian package)          - texlive-bin 2007-1 (embed)
41  kadu (not packaged in Debian)          NOTE: links to poppler
42  GNU gadu (not yet packaged in Debian)          - koffice <unfixed> (embed; bug #436163)
43            - libextractor 0.5.12-1 (embed)
44  xmlrpc: (which package is the "origin" of this code?)          NOTE: libextractor is using its own pdf decoder now
45  drupal          - libextractor 0.5.12-1 (embed)
46  phpgroupware          - pdfkit.framework 0.8-4 (embed)
47  egroupware          - ipe <unfixed> (embed)
48  phpwiki          NOTE: embeds small parts with renamed source files: ipestdfonts.cpp, ipefonts.cpp, ipedct.cpp
49  php4 (php-pear, IIRC this was reorganized some weeks ago?)          - ruby-gnome2 <unknown> (embed)
50  tikiwiki          NOTE: copy only present in source but links to poppler
51    
52  shtool: (affects build-time only)  ppmd
53  mysql-ocaml          - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
54  php4  
55    peercast
56  mozilla:          - gnome-peercast <unfixed> (embed)
57  mozilla-firefox          NOTE: gnome-peercast may better be removed, see #466539
58  mozilla-thunderbird  
59  firefox (to be removed)  silc-toolkit
60  thunderbird (to be removed)          - silc-client 1.1~beta6-1 (embed)
61  iceweasel  
62  iceape  dietlibc
63  icedove          - ccontrol 0.9.1+20071204-1 (static)
64  xulrunner  
65  nvu (no longer in Debian)  libiax
66            - iaxmodem <unfixed> (embed)
67  xli:  
68  xloadimage  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
69            - dpkg <unfixed> (embed)
70  lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)          NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
71  openmotif          - rsync <unfixed> (embed)
72  xfree86/xorg (in libxpm)          NOTE: somehow derived code base
73            - mono <unfixed> (embed)
74  kerberized apps with BSD origin:          TODO: check mozilla
75  krb4          - Linux kernels <unfixed> (embed)
76  krb5          - pvpgn 1.7.8-2 (embed)
77  heimdal          - mrtg 2.12.2-1 (embed)
78            - rpm <unknown> (embed)
79  grip: (which pkg is the origin?)          NOTE: pinged anibal since when rpm was fixed
80  libcdaudio  
81  grip  libbz2
82  gnome-vfs (vfs2 as well?)          - dpkg <unfixed> (static)
83    
84  fudforum:  ekg
85  phpgroupware-fudforum          - centericq <unfixed> (embed)
86  egroupware-fudforum (removed from egroupware after sarge)          - gaim <unfixed> (embed)
87            - pigdin <unfixed> (embed)(links dynamically against libgadu)
88  cvs:          - kopete 4:3.3.2-5 (embed)
89  gcvs (at least an additional script is included, check if there's more)          - kadu <unfixed> (embed)
90            - gadu <unfixed> (embed)
91  pcre:          NOTE: g/kadu not packaged in Debian yet
92  all pythons  
93  php4 (src included, but Debian package links dynamically)  xmlrpc (which package is the "origin" of this code?)
94  analog (src included, but Debian package links dynamically)          - drupal <unfixed> (embed)
95  libgoffice-1          - phpgroupware <unfixed> (embed)
96  vfu          - egroupware <unfixed> (embed)
97  tf5 (since 5.0beta7 the Debian package links dynamically)          - phpwiki (embed)
98  monotone          - php4 <unfixed> (embed)
99            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
100  tiff:  
101  wxpythongtk (check, which debian pkg this is in)  shtool (affects build-time only)
102  older kdegraphics/kpdf releases < 3.3 embedded a copy          - mysql-ocaml <unfixed> (embed)
103            - php4 <unfixed> (embed)
104  uudeview:  
105  libconvert-uulib-perl  mozilla source code
106            - mozilla-firefox <unfixed> (embed)
107  sqlite: (not affected by security vulnerabilities so far)          - mozilla-thunderbird
108  amarok          - firefox <removed>
109  monotone          [etch] - firefox <unfixed> (embed)
110            - thunderbird <removed>
111  util-linux/mount:          [etch] - thunderbird <unfixed> (embed)
112  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb          - iceweasel <unfixed> (embed)
113            - iceape <unfixed> (embed)
114  webmin:          - icedove <unfixed> (embed)
115  usermin (only in sarge)          - xulrunner <unfixed> (embed)
116            - nvu <removed> (embed)
117  sylpheed:  
118  sylpheed-claws  xli
119            - xloadimage <unfixed> (embed)
120  phpsysinfo:  
121  egroupware  lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
122  phpgroupware          - openmotif <unfixed> (embed)
123            - xfree86/xorg <unfixed> (embed)
124            NOTE: in libxpm
125    
126    kerberized apps with BSD origin
127            - krb4 <unfixed> (embed)
128            - krb5 <unfixed> (embed)
129            - heimdal <unfixed> (embed)
130    
131    grip (which pkg is the origin?)
132            - libcdaudio
133            - grip
134            - gnome-vfs
135            TODO: check vfs2 as well
136    
137    fudforum
138            - phpgroupware-fudforum <unfixed> (embed)
139            - egroupware-fudforum <removed>
140            [sarge] - egroupware-fudforum <unfixed> (embed)
141    
142    cvs
143            - gcvs <unfixed> (embed)
144            NOTE: see cvsunix/src in tarball
145    
146    pcre
147            - python* <unfixed> (embed)
148            - php4 <unknown> (embed)
149            - analog 2:5.23-0woody1 (embed)
150            - libgoffice-1 <unfixed> (embed)
151            - vfu 4.06-4.1 (embed; bug #450754)
152            - tf5 5.0beta7-1 (embed)
153            - monotone <unfixed> (embed)
154            NOTE: this only affects versions >= 0.37
155            - glib <unfixed> (embed)
156            NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic
157            - apache2 2.0.53-4 (embed)
158            - exim4 4.10-0.srh20.12 (embed)
159            - yacas <unfixed> (embed)
160            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
161            - gtamsanalyzer.app 0.42-5 (embed)
162            - tin <unknown> (embed)
163    
164    tiff
165            - wxwindows2.4 2.2.1 (embed)
166    
167    uudeview
168            - libconvert-uulib-perl <unfixed> (embed)
169    
170    sqlite (not affected by security vulnerabilities so far)
171            - amarok <unfixed> (embed)
172            - monotone <unfixed> (embed)
173            - iceweasel <unfixed> (embed)
174    
175    util-linux/mount
176            - loop-aes-utils <unfixed> (embed)
177            NOTE: contains code from util-linux' mount in the mount-aes-udeb
178    
179    webmin
180            - usermin <unknown> (embed)
181            [sarge] - usermin <unfixed> (embed)
182    
183    sylpheed
184            - sylpheed-claws <unfixed> (fork)
185    
186    phpsysinfo
187            - egroupware <unfixed> (embed)
188            - phpgroupware <unfixed> (embed)
189    
190    phpldapadmin
191            [sarge] - egroupware <unfixed> (embed)
192            NOTE: removed from egroupware after sarge
193    
194    chmlib
195            - kchmviewer <unknown> (embed)
196    
197    libavcodec/libavformat (source: ffmpeg)
198            - mplayer <unfixed> (embed; bug #395252)
199            - xvidcap <unfixed> (embed)
200            - kino <unfixed> (static)
201            - vlc <unfixed> (static)
202            - smilutils <unfixed> (static)
203            - motion <unfixed> (static)
204            - gst-ffmpeg <unfixed> (embed)
205            - gstreamer0.10-ffmpeg <unfixed> (embed)
206            - xmovie <unfixed>
207            TODO: gimp-gap (potentially using ffmpeg code as well)
208    
209    mad MPEG decoding lib
210            - mad <unfixed> (embed)
211            - xine-lib <unfixed> (embed)
212    
 phpldapadmin:  
 egroupware (removed from egroupware after sarge)  
   
 chmlib:  
 kchmviewer (not packaged in Debian)  
   
 libavcodec/libavformat:  
 ffmpeg  
 xine-lib  
 xvidcap  
 kino (links statically, does not include code)  
 vlc (links statically, does not include code)  
 smilutils (links statically, does not include code)  
 motion (links statically, does not include code)  
 gst-ffmpeg  
 gstreamer0.10-ffmpeg  
 xmovie  
   
 mad MPEG decoding lib:  
 mad  
 xine-lib  
   
 libdts:  
213  libdts  libdts
214  xine-lib          - xine-lib <unfixed> (embed)
215    
 flac:  
216  flac  flac
217  xine-lib          - xine-lib <unfixed> (embed)
   
 liba52:  
 a52dec  
 xine-lib  
   
 libmpeg2:  
 mpeg2dec  
 xine-lib  
218    
219  curl:  liba52
220  wget (code for NTLM authentication)          - a52dec <unfixed> (embed)
221            - xine-lib <unfixed> (embed)
222    
223  TODO evaluate:  libmpeg2
224  gimp-gap (potentially using ffmpeg code as well)          - mpeg2dec <unfixed> (embed)
225            - xine-lib <unfixed> (embed)
226    
227  uw-imap:  curl
228  pine          - wget <unfixed> (embed)
229  alpine          NOTE: code for NTLM authentication
230    
231  imagemagick:  uw-imap
232  graphicsmagick          - pine <unfixed> (embed)
233            - alpine <unfixed> (embed)
234    
235  halibut:  imagemagick
236  nsis          - graphicsmagick <unfixed> (fork)
237    
238  libghttp:  halibut
239  hotway          - nsis <unfixed> (embed)
240    
241  libsndfile:  libghttp
242  ardour          - hotway <unfixed> (embed)
243    
244  glibmm2.4:  libsndfile
245  ardour          - ardour <unfixed> (embed)
246    
247  libgnomecanvasmm2.6:  glibmm2.4
248  ardour          - ardour <unfixed> (embed)
249    
250  libsigc++-2.0:  libgnomecanvasmm2.6
251  ardour          - ardour <unfixed> (embed)
252    
253  soundtouch:  libsigc++-2.0
254  ardour          - ardour <unfixed> (embed)
255    
256  libmms:  soundtouch
257  xine-lib          - ardour <unfixed> (embed)
 mimms  
258    
259  FCKeditor:  libmms
260  knowledgeroot          - xine-lib <unfixed> (embed)
261            - mimms <unfixed> (embed)
262    
263  Moodle contains lots of things:  fckeditor
264  AdoDB          - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
265  AdoDB-XML Schema          - moin <unfixed> (embed; bug #452599)
266  ipatlas          - karrigell <unfixed> (embed; bug #452598)
267  PHPMailer          - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
 Smarty  
 htmlArea  
 TinyMCE  
 bennu  
268    
269  TinyMCE:  ipatlas (not packaged in Debian)
270  wordpress          - moodle <unfixed> (embed)
 moodle  
 knowledgeroot  
 joomla (ITP)  
271    
272  scintilla:  libphp-phpmailer
273  scite          - moodle <unfixed> (embed)
 qscintilla  
 geany  
274    
275  libphp-adodb:  htmlArea (not packaged in Debian)
276  gallery2          - moodle <unfixed> (embed)
 phppgadmin  
 egroupware  
 phpwiki  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
277    
278  gzip:  giflib:
279  linux-kernel (lib/inflate.c)          - wine <unfixed> (embed; bug #466181)
 klibc (based on linux-kernel gzip code)  
 busybox  
280    
281  ffmpeg:  bennu (not packaged in Debian)
282  mplayer (#395252)          - moodle <unfixed> (embed)
283    
284  neon:  smarty:
285  cadaver (all, but being worked on: #188381)          - moodle <unfixed> (embed; bug #471158)
286  gnome-vfs2 (#395874)          - gallery2 <unfixed> (embed; bug #471160)
287  litmus (#395875)          - mahara 0.9.2-2 (embed; bug #471201)
288  screem (sarge only)          - gosa 2.4beta1-1 (embed; bug #471200)
 sitecopy (#395876)  
 tla (etch/sid only: #395877)  
289    
290  libmodplug:  TinyMCE
291  gst-plugins-bad0.10          - wordpress <unfixed> (embed)
292            - moodle <unfixed> (embed)
293            - knowledgeroot <unfixed> (embed)
294            - joomla <itp> (bug #326398)
295    
296    scintilla
297            - scite <unfixed> (embed)
298            - qscintilla <unfixed> (embed)
299            - qscintilla2 <unfixed> (embed)
300            - geany <unfixed> (embed)
301    
302    libphp-adodb
303            - moodle <unfixed> (embed)
304            NOTE: also AdoDB-XML Schema
305            - gallery2 <unfixed> (embed)
306            - phppgadmin <unfixed> (embed)
307            - egroupware <unfixed> (embed)
308            - phpwiki <unfixed> (embed)
309            - ipplan <unfixed> (embed)
310            - typo3 <unfixed> (embed)
311            - moodle <unfixed> (embed)
312            - cacti <unknown> (embed)
313            [sarge] - cacti <unfixed> (embed)
314            NOTE: dependency exists, but internal version is used
315    
316    gzip
317            - linux-kernel <unfixed> (embed)
318            NOTE: lib/inflate.c
319            - klibc <unfixed> (embed)
320            NOTE: based on linux-kernel gzip code
321            - busybox <unfixed> (embed)
322    
323    neon
324            - cadaver <unfixed> (embed; bug #188381)
325            - gnome-vfs2 <unfixed> (embed; bug #395874)
326            - litmus <unfixed> (embed; #395875)
327            [sarge] - screem <unfixed> (embed)
328            - sitecopy <unfixed> (embed; bug #395876)
329            [etch] - tla <unfixed> (embed; bug #395877)
330            [sarge] - tla <unfixed> (embed; bug #395877)
331    
332    libmodplug
333            - gst-plugins-bad0.10 <unfixed> (embed)
334    
335    libvncserver
336            - vino <unfixed> (embed)
337    
338    putty
339            - filezilla <unfixed> (embed)
340    
341    tinyxml (not packaged in Debian)
342            - filezilla <unfixed>
343    
344    gv
345            - evince <unfixed> (embed)
346            NOTE: ps/ tree from gv 3.5.8
347            - evince-gtk <unfixed> (embed)
348            NOTE: not packaged in Debian
349    
350    libXbae
351            [etch] - libpawlib2-lesstif <unfixed> (embed)
352            NOTE: from Cernlib
353    
354    libXaw
355            [etch] - libpawlib2-lesstif
356            NOTE: from Cernlib
357            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
358    
359    libgd2
360            - graphviz <unfixed> (embed)
361            NOTE: lib/gd seems to be 2.0.33
362            - wml <unfixed> (embed)
363            NOTE: derived from gd 1.6.3
364    
365    rar
366            - unrar-nonfree <unfixed> (embed)
367    
368    unrar-free (maybe this code is derived from the original rar, too?)
369            - clamav <unfixed> (embed)
370            NOTE: seems to be disabled in default config
371    
372    mplayer (DirectMedia Object loader)
373            - xine-lib <unfixed> (embed)
374            NOTE: src/libw32dll/
375            - vlc <unfixed> (embed)
376            NOTE: modules/codec/dmo/
377    
378    libwpd (WordPerfect converter)
379            - openoffice.org <unfixed> (embed)
380    
381    fsplib (http://sourceforge.net/projects/fsp/)
382            - gftp <unfixed> (embed)
383            NOTE: lib/fsplib version 0.3
384    
385    librpcsecgss
386            - krb5 <unfixed> (embed)
387    
388    jasper
389            - ghostscript <unfixed> (embed)
390            - gs-gpl <unfixed> (embed)
391    
392  libvncserver:  libidn
393  vino          - monotone <unfixed> (embed)
394    
395  putty:  liblua
396  filezilla          - monotone <unfixed> (embed)
397    
398  tinyxml (not packaged in Debian):  libbotan
399  filezilla          - montone <unfixed> (embed)
400    
401  gv:  NetXX
402  evince (ps/ tree from gv 3.5.8)          - monotone <unfixed> (embed)
 evince-gtk (not packaged in Debian)  
403    
404  libXbae:  libgc
405  libpawlib2-lesstif package (from Cernlib)          - mono <unfixed> (embed)
406    
407  libXaw:  lzma
408  libpawlib2-lesstif package (from Cernlib)          - p7zip <unfixed> (embed)
409    
410  (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  lzo
411            - grub2 <unfixed> (embed)
412    
413  libgd2:  yassl
414  graphviz (lib/gd seems to be 2.0.33)          - mysql-dfsg-5.0 <unfixed> (embed)
415    
416  rar:  pax code
417  unrar-nonfree          - tar <unfixed> (embed)
418            - cpio <unfixed> (embed)
419    
420  unrar-free: (maybe this code is derived from the original rar, too?)  t1lib
421  clamav (seems to be disabled in default config)          - tetex-bin 2.0.2-1 (embed)
422            - texlive-bin <unknown> (embed)
423    
424  mplayer (DirectMedia Object loader):  guichan
425  xine-lib (src/libw32dll/)          - boswars <unfixed> (embed)
426  vlc (modules/codec/dmo/)          NOTE: maintainer notified us, working on it
427    
428  libwpd (WordPerfect converter):  tolua
429  openoffice.org          - boswars <unfixed> (embed)
430            NOTE: maintainer notified us, working on it
431    
432  fsplib (http://sourceforge.net/projects/fsp/):  asio-dev
433  gftp (lib/fsplib version 0.3)          - luxrender <unfixed> (embed)
434            NOTE: maintainer notified us, working on it
435            NOTE: may be merged with boost "soon"
436    
437  librpcsecgss:  xine-lib
438  krb5          - vlc <unfixed> (embed)
439            NOTE: only parts included in modules/access/rtsp
440    
441  jasper:  netpbm
442  ghostscript          - tcl8.3 <unfixed> (embed)
443  gs-gpl          - tcl8.4 <unfixed> (embed)
444            - tcl8.5 <unfixed> (embed)
445            NOTE: generic/tkImgGIF.c
446    
447    tk8.5
448            - tk8.0 <removed> (old-version)
449            - tk8.3 <unfixed> (old-version)
450            - tk8.4 <unfixed> (old-version)
451            - perl-tk <unfixable> (fork)
452    
453    samba
454            - mc <unfixed> (embed)
455            NOTE: maintainer is aware of this, currently searching a solution
456    
457    plib1.8.4c2
458            - boson <unfixed> (fork)
459            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
460    
461    fribidi
462            - quesoglc <unfixed> (embed)
463    
464    glew
465            - quesoglc <unfixed> (embed)
466    
467    minorGems
468            - transcend <unfixed> (embed)
469            - cultivation <unfixed> (embed)
470    
471    libarchive
472            - tar <unfixed> (embed)
473            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
474            - cpio <unfixed> (embed)
475            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
476    
477  monotone embeds lots of things:  webkit
478  liblua          - qt4-x11 <unfixed> (embed)
 libidn  
 libsqlite3  
 libbotan  
 NetXX  
 pcre (starting from 0.37)  

Legend:
Removed from v.7007  
changed lines
  Added in v.8587

  ViewVC Help
Powered by ViewVC 1.1.5