/[secure-testing]/data/embedded-code-copies
ViewVC logotype

Diff of /data/embedded-code-copies

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 7743 by jmm-guest, Fri Dec 28 16:38:52 2007 UTC revision 8587 by nion, Sun Apr 20 18:24:56 2008 UTC
# Line 1  Line 1 
1  Embedded code copies  Embedded code copies
2  ====================  ====================
3    
4  This file collects cases, where a source package embeds code from  This file collects source packages that embed code from other projects.
5  other projects which is considered bad for fixing security flaws  This is considered bad for fixing security flaws because the fix needs
6  because the fix needs to be applied in multiple source packages.  to be applied in multiple source packages.
7    
8  Format:  Format:
9  <srcpkg> (<optional comment about srcpkg>)  <srcpkg> (<optional comment about srcpkg>)
10          - <embedding srcpkg> <status> (<sort>; bug #<number>)          - <embedding srcpkg> <status> (<sort>; bug #<number>)
11          NOTE: optional comments about the linkage of the embedding srcpkg          NOTE: optional comments about the linkage of the embedding srcpkg
12    
13  status: version number fixing the embedded copy, <unfixed>, <removed> or <unknown> if the version number can not be determined  status: version number fixing the embedded copy, <unfixed>, <removed>,
14  sort: static (linking statically against a lib), embed (embedding a copy of the library into another source package)          <itp> or <unknown> if the version number can not be determined
15            <unfixable> for unavoidable cases (e.g., forks that add real value)
16    sort: static (linking statically against a lib)
17          embed (embedding a copy of the library into another source package)
18          fork (the package is not just embedding code but it is a fork and
19                thus might share parts of the source code)
20          old-version (the package is an older version of essentially
21                       the same code)
22    
23    The srcpkg might be some string to identify the code if there is no
24    specific source package.
25    
26    Everything up to the next line is ignored.
27    ---BEGIN
28  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)  xpdf (some srcpkgs use xpdf2 code, some xpdf3 code)
29          NOTE: Fixed packages link to poppler library unless otherwise noted          NOTE: Fixed packages link to poppler library unless otherwise noted
30          - gpdf <removed>          - gpdf <removed>
# Line 37  xpdf (some srcpkgs use xpdf2 code, some Line 49  xpdf (some srcpkgs use xpdf2 code, some
49          - ruby-gnome2 <unknown> (embed)          - ruby-gnome2 <unknown> (embed)
50          NOTE: copy only present in source but links to poppler          NOTE: copy only present in source but links to poppler
51    
52  silc-toolkit:  ppmd
53            - libcomplearn-mod-ppmd <unfixed> (embed; bug #458152)
54    
55    peercast
56            - gnome-peercast <unfixed> (embed)
57            NOTE: gnome-peercast may better be removed, see #466539
58    
59    silc-toolkit
60          - silc-client 1.1~beta6-1 (embed)          - silc-client 1.1~beta6-1 (embed)
61    
62  dietlibc:  dietlibc
63          - ccontrol 0.9.1+20071204-1 (static)          - ccontrol 0.9.1+20071204-1 (static)
64    
65  libiax:  libiax
66          - iaxmodem <unfixed> (embed)          - iaxmodem <unfixed> (embed)
67    
68  zlib code: (lots of apps embed a copy, but link dynamically, but there are a few exceptions)  zlib (lots of apps embed a copy, but link dynamically, but there are a few exceptions)
69  dpkg          - dpkg <unfixed> (embed)
70  rsync (somehow derived code base)          NOTE: see 18196.48620.491996.624772@davenant.relativity.greenend.org.uk on debian-devel for discussion
71  mono          - rsync <unfixed> (embed)
72  mozilla(?)          NOTE: somehow derived code base
73  Linux kernels          - mono <unfixed> (embed)
74  pvpgn (links dynamically since 1.7.8-2)          TODO: check mozilla
75  mrtg (links dynamically since 2.12.2-1)          - Linux kernels <unfixed> (embed)
76  rpm          - pvpgn 1.7.8-2 (embed)
77            - mrtg 2.12.2-1 (embed)
78  libbz2:          - rpm <unknown> (embed)
79  dpkg (statically linked)          NOTE: pinged anibal since when rpm was fixed
80    
81  libgadu/ekg:  libbz2
82  centericq          - dpkg <unfixed> (static)
83  gaim  
84  pigdin (links dynamically against libgadu)  ekg
85  kopete (ships the code, but links dynamically in the Debian package)          - centericq <unfixed> (embed)
86  kadu (not packaged in Debian)          - gaim <unfixed> (embed)
87  GNU gadu (not yet packaged in Debian)          - pigdin <unfixed> (embed)(links dynamically against libgadu)
88            - kopete 4:3.3.2-5 (embed)
89  xmlrpc: (which package is the "origin" of this code?)          - kadu <unfixed> (embed)
90  drupal          - gadu <unfixed> (embed)
91  phpgroupware          NOTE: g/kadu not packaged in Debian yet
92  egroupware  
93  phpwiki  xmlrpc (which package is the "origin" of this code?)
94  php4 (php-pear, IIRC this was reorganized some weeks ago?)          - drupal <unfixed> (embed)
95            - phpgroupware <unfixed> (embed)
96  shtool: (affects build-time only)          - egroupware <unfixed> (embed)
97  mysql-ocaml          - phpwiki (embed)
98  php4          - php4 <unfixed> (embed)
99            TODO: check, php-pear, IIRC this was reorganized some weeks ago?
100  mozilla:  
101  mozilla-firefox  shtool (affects build-time only)
102  mozilla-thunderbird          - mysql-ocaml <unfixed> (embed)
103  firefox (to be removed)          - php4 <unfixed> (embed)
104  thunderbird (to be removed)  
105  iceweasel  mozilla source code
106  iceape          - mozilla-firefox <unfixed> (embed)
107  icedove          - mozilla-thunderbird
108  xulrunner          - firefox <removed>
109  nvu (no longer in Debian)          [etch] - firefox <unfixed> (embed)
110            - thunderbird <removed>
111  xli:          [etch] - thunderbird <unfixed> (embed)
112  xloadimage          - iceweasel <unfixed> (embed)
113            - iceape <unfixed> (embed)
114  lesstif: (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)          - icedove <unfixed> (embed)
115  openmotif          - xulrunner <unfixed> (embed)
116  xfree86/xorg (in libxpm)          - nvu <removed> (embed)
117    
118  kerberized apps with BSD origin:  xli
119  krb4          - xloadimage <unfixed> (embed)
120  krb5  
121  heimdal  lesstif (beware: two different lesstif APIs supported in one package, MOTIF 1.2 discarded upstream)
122            - openmotif <unfixed> (embed)
123  grip: (which pkg is the origin?)          - xfree86/xorg <unfixed> (embed)
124  libcdaudio          NOTE: in libxpm
125  grip  
126  gnome-vfs (vfs2 as well?)  kerberized apps with BSD origin
127            - krb4 <unfixed> (embed)
128  fudforum:          - krb5 <unfixed> (embed)
129  phpgroupware-fudforum          - heimdal <unfixed> (embed)
130  egroupware-fudforum (removed from egroupware after sarge)  
131    grip (which pkg is the origin?)
132  cvs:          - libcdaudio
133  gcvs (at least an additional script is included, check if there's more)          - grip
134            - gnome-vfs
135  pcre:          TODO: check vfs2 as well
136  all pythons  
137  php4 (src included, but Debian package links dynamically)  fudforum
138  analog (src included, but Debian package links dynamically)          - phpgroupware-fudforum <unfixed> (embed)
139  libgoffice-1          - egroupware-fudforum <removed>
140  vfu (removed linking against embedded copy in 4.06-4.1; #450754)          [sarge] - egroupware-fudforum <unfixed> (embed)
141  tf5 (since 5.0beta7 the Debian package links dynamically)  
142  monotone (including this starting from 0.37)  cvs
143  glib (2.14 series for gregex support, only for udeb, regular packag links dynamic)          - gcvs <unfixed> (embed)
144  apache2 (since 2.0.53-4 uses 040_link_external_pcre patch)          NOTE: see cvsunix/src in tarball
145  exim4 (since 4.10-0.srh20.12 uses 36_pcre patch to use external pcre)  
146  yacas (<= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway)  pcre
147  gtamsanalyzer.app (links dynamically since 0.42-5)          - python* <unfixed> (embed)
148            - php4 <unknown> (embed)
149  tiff:          - analog 2:5.23-0woody1 (embed)
150  wxpythongtk (check, which debian pkg this is in)          - libgoffice-1 <unfixed> (embed)
151  older kdegraphics/kpdf releases < 3.3 embedded a copy          - vfu 4.06-4.1 (embed; bug #450754)
152            - tf5 5.0beta7-1 (embed)
153  uudeview:          - monotone <unfixed> (embed)
154  libconvert-uulib-perl          NOTE: this only affects versions >= 0.37
155            - glib <unfixed> (embed)
156  sqlite: (not affected by security vulnerabilities so far)          NOTE: 2.14 series for gregex support, only for udeb, regular packag links dynamic
157  amarok          - apache2 2.0.53-4 (embed)
158  monotone          - exim4 4.10-0.srh20.12 (embed)
159  iceweasel          - yacas <unfixed> (embed)
160            NOTE: <= 1.0.x; is using pcre to scan text, can execute shell commands via the syntax anyway
161  util-linux/mount:          - gtamsanalyzer.app 0.42-5 (embed)
162  loop-aes-utils contains code from util-linux' mount in the mount-aes-udeb          - tin <unknown> (embed)
163    
164  webmin:  tiff
165  usermin (only in sarge)          - wxwindows2.4 2.2.1 (embed)
166    
167  sylpheed:  uudeview
168  sylpheed-claws          - libconvert-uulib-perl <unfixed> (embed)
169    
170  phpsysinfo:  sqlite (not affected by security vulnerabilities so far)
171  egroupware          - amarok <unfixed> (embed)
172  phpgroupware          - monotone <unfixed> (embed)
173            - iceweasel <unfixed> (embed)
174  phpldapadmin:  
175  egroupware (removed from egroupware after sarge)  util-linux/mount
176            - loop-aes-utils <unfixed> (embed)
177  chmlib:          NOTE: contains code from util-linux' mount in the mount-aes-udeb
178  kchmviewer (ships the code but links dynamically)  
179    webmin
180  libavcodec/libavformat (source: ffmpeg):          - usermin <unknown> (embed)
181  mplayer (#395252)          [sarge] - usermin <unfixed> (embed)
182  xvidcap  
183  kino (links statically, does not include code)  sylpheed
184  vlc (links statically, does not include code)          - sylpheed-claws <unfixed> (fork)
185  smilutils (links statically, does not include code)  
186  motion (links statically, does not include code)  phpsysinfo
187  gst-ffmpeg          - egroupware <unfixed> (embed)
188  gstreamer0.10-ffmpeg          - phpgroupware <unfixed> (embed)
189  xmovie  
190    phpldapadmin
191  mad MPEG decoding lib:          [sarge] - egroupware <unfixed> (embed)
192  mad          NOTE: removed from egroupware after sarge
193  xine-lib  
194    chmlib
195            - kchmviewer <unknown> (embed)
196    
197    libavcodec/libavformat (source: ffmpeg)
198            - mplayer <unfixed> (embed; bug #395252)
199            - xvidcap <unfixed> (embed)
200            - kino <unfixed> (static)
201            - vlc <unfixed> (static)
202            - smilutils <unfixed> (static)
203            - motion <unfixed> (static)
204            - gst-ffmpeg <unfixed> (embed)
205            - gstreamer0.10-ffmpeg <unfixed> (embed)
206            - xmovie <unfixed>
207            TODO: gimp-gap (potentially using ffmpeg code as well)
208    
209    mad MPEG decoding lib
210            - mad <unfixed> (embed)
211            - xine-lib <unfixed> (embed)
212    
 libdts:  
213  libdts  libdts
214  xine-lib          - xine-lib <unfixed> (embed)
215    
 flac:  
216  flac  flac
217  xine-lib          - xine-lib <unfixed> (embed)
   
 liba52:  
 a52dec  
 xine-lib  
   
 libmpeg2:  
 mpeg2dec  
 xine-lib  
   
 curl:  
 wget (code for NTLM authentication)  
   
 TODO evaluate:  
 gimp-gap (potentially using ffmpeg code as well)  
   
 uw-imap:  
 pine  
 alpine  
   
 imagemagick:  
 graphicsmagick  
   
 halibut:  
 nsis  
   
 libghttp:  
 hotway  
   
 libsndfile:  
 ardour  
   
 glibmm2.4:  
 ardour  
218    
219  libgnomecanvasmm2.6:  liba52
220  ardour          - a52dec <unfixed> (embed)
221            - xine-lib <unfixed> (embed)
222    
223  libsigc++-2.0:  libmpeg2
224  ardour          - mpeg2dec <unfixed> (embed)
225            - xine-lib <unfixed> (embed)
226    
227  soundtouch:  curl
228  ardour          - wget <unfixed> (embed)
229            NOTE: code for NTLM authentication
230    
231  libmms:  uw-imap
232  xine-lib          - pine <unfixed> (embed)
233  mimms          - alpine <unfixed> (embed)
   
 FCKeditor: (packaged as fckeditor)  
 knowledgeroot  
 moin (452599)  
 karrigell (452598)  
 gforge-plugins-extra (fixed since 4.6.99+svn6225-1)  
   
   
   
 Moodle contains lots of things:  
 AdoDB  
 AdoDB-XML Schema  
 ipatlas  
 PHPMailer  
 Smarty  
 htmlArea  
 TinyMCE  
 bennu  
   
 TinyMCE:  
 wordpress  
 moodle  
 knowledgeroot  
 joomla (ITP)  
   
 scintilla:  
 scite  
 qscintilla  
 qscintilla2  
 geany  
   
 libphp-adodb:  
 gallery2  
 phppgadmin  
 egroupware  
 phpwiki  
 ipplan  
 typo3  
 moodle  
 cacti (dependency exists, but internal version is used -- only in sarge, fixed in etch)  
   
 gzip:  
 linux-kernel (lib/inflate.c)  
 klibc (based on linux-kernel gzip code)  
 busybox  
234    
235  neon:  imagemagick
236  cadaver (all, but being worked on: #188381)          - graphicsmagick <unfixed> (fork)
 gnome-vfs2 (#395874)  
 litmus (#395875)  
 screem (sarge only)  
 sitecopy (#395876)  
 tla (etch/sid only: #395877)  
237    
238  libmodplug:  halibut
239  gst-plugins-bad0.10          - nsis <unfixed> (embed)
240    
241  libvncserver:  libghttp
242  vino          - hotway <unfixed> (embed)
243    
244  putty:  libsndfile
245  filezilla          - ardour <unfixed> (embed)
246    
247  tinyxml (not packaged in Debian):  glibmm2.4
248  filezilla          - ardour <unfixed> (embed)
249    
250  gv:  libgnomecanvasmm2.6
251  evince (ps/ tree from gv 3.5.8)          - ardour <unfixed> (embed)
 evince-gtk (not packaged in Debian)  
252    
253  libXbae:  libsigc++-2.0
254  libpawlib2-lesstif package (from Cernlib)          - ardour <unfixed> (embed)
255    
256  libXaw:  soundtouch
257  libpawlib2-lesstif package (from Cernlib)          - ardour <unfixed> (embed)
258    
259  (I plan to deal with the above two cases after Etch release. -- KevinMcCarty)  libmms
260            - xine-lib <unfixed> (embed)
261            - mimms <unfixed> (embed)
262    
263  libgd2:  fckeditor
264  graphviz (lib/gd seems to be 2.0.33)          - knowledgeroot 0.9.8.5-3 (embed; bug #461555)
265            - moin <unfixed> (embed; bug #452599)
266            - karrigell <unfixed> (embed; bug #452598)
267            - gforge-plugins-extra 4.6.99+svn6225-1 (embed)
268    
269  rar:  ipatlas (not packaged in Debian)
270  unrar-nonfree          - moodle <unfixed> (embed)
271    
272  unrar-free: (maybe this code is derived from the original rar, too?)  libphp-phpmailer
273  clamav (seems to be disabled in default config)          - moodle <unfixed> (embed)
274    
275  mplayer (DirectMedia Object loader):  htmlArea (not packaged in Debian)
276  xine-lib (src/libw32dll/)          - moodle <unfixed> (embed)
 vlc (modules/codec/dmo/)  
277    
278  libwpd (WordPerfect converter):  giflib:
279  openoffice.org          - wine <unfixed> (embed; bug #466181)
280    
281  fsplib (http://sourceforge.net/projects/fsp/):  bennu (not packaged in Debian)
282  gftp (lib/fsplib version 0.3)          - moodle <unfixed> (embed)
283    
284  librpcsecgss:  smarty:
285  krb5          - moodle <unfixed> (embed; bug #471158)
286            - gallery2 <unfixed> (embed; bug #471160)
287            - mahara 0.9.2-2 (embed; bug #471201)
288            - gosa 2.4beta1-1 (embed; bug #471200)
289    
290  jasper:  TinyMCE
291  ghostscript          - wordpress <unfixed> (embed)
292  gs-gpl          - moodle <unfixed> (embed)
293            - knowledgeroot <unfixed> (embed)
294  libidn:          - joomla <itp> (bug #326398)
295  monotone  
296    scintilla
297  liblua:          - scite <unfixed> (embed)
298  monotone          - qscintilla <unfixed> (embed)
299            - qscintilla2 <unfixed> (embed)
300  libbotan:          - geany <unfixed> (embed)
301  montone  
302    libphp-adodb
303  NetXX:          - moodle <unfixed> (embed)
304  monotone          NOTE: also AdoDB-XML Schema
305            - gallery2 <unfixed> (embed)
306  libgc:          - phppgadmin <unfixed> (embed)
307  mono          - egroupware <unfixed> (embed)
308            - phpwiki <unfixed> (embed)
309  lzma:          - ipplan <unfixed> (embed)
310  p7zip          - typo3 <unfixed> (embed)
311            - moodle <unfixed> (embed)
312  lzo:          - cacti <unknown> (embed)
313  grub2          [sarge] - cacti <unfixed> (embed)
314            NOTE: dependency exists, but internal version is used
315    
316    gzip
317            - linux-kernel <unfixed> (embed)
318            NOTE: lib/inflate.c
319            - klibc <unfixed> (embed)
320            NOTE: based on linux-kernel gzip code
321            - busybox <unfixed> (embed)
322    
323    neon
324            - cadaver <unfixed> (embed; bug #188381)
325            - gnome-vfs2 <unfixed> (embed; bug #395874)
326            - litmus <unfixed> (embed; #395875)
327            [sarge] - screem <unfixed> (embed)
328            - sitecopy <unfixed> (embed; bug #395876)
329            [etch] - tla <unfixed> (embed; bug #395877)
330            [sarge] - tla <unfixed> (embed; bug #395877)
331    
332    libmodplug
333            - gst-plugins-bad0.10 <unfixed> (embed)
334    
335    libvncserver
336            - vino <unfixed> (embed)
337    
338    putty
339            - filezilla <unfixed> (embed)
340    
341    tinyxml (not packaged in Debian)
342            - filezilla <unfixed>
343    
344    gv
345            - evince <unfixed> (embed)
346            NOTE: ps/ tree from gv 3.5.8
347            - evince-gtk <unfixed> (embed)
348            NOTE: not packaged in Debian
349    
350    libXbae
351            [etch] - libpawlib2-lesstif <unfixed> (embed)
352            NOTE: from Cernlib
353    
354    libXaw
355            [etch] - libpawlib2-lesstif
356            NOTE: from Cernlib
357            NOTE: I plan to deal with the above two cases after Etch release. -- KevinMcCarty
358    
359    libgd2
360            - graphviz <unfixed> (embed)
361            NOTE: lib/gd seems to be 2.0.33
362            - wml <unfixed> (embed)
363            NOTE: derived from gd 1.6.3
364    
365    rar
366            - unrar-nonfree <unfixed> (embed)
367    
368    unrar-free (maybe this code is derived from the original rar, too?)
369            - clamav <unfixed> (embed)
370            NOTE: seems to be disabled in default config
371    
372    mplayer (DirectMedia Object loader)
373            - xine-lib <unfixed> (embed)
374            NOTE: src/libw32dll/
375            - vlc <unfixed> (embed)
376            NOTE: modules/codec/dmo/
377    
378    libwpd (WordPerfect converter)
379            - openoffice.org <unfixed> (embed)
380    
381    fsplib (http://sourceforge.net/projects/fsp/)
382            - gftp <unfixed> (embed)
383            NOTE: lib/fsplib version 0.3
384    
385    librpcsecgss
386            - krb5 <unfixed> (embed)
387    
388    jasper
389            - ghostscript <unfixed> (embed)
390            - gs-gpl <unfixed> (embed)
391    
392    libidn
393            - monotone <unfixed> (embed)
394    
395    liblua
396            - monotone <unfixed> (embed)
397    
398    libbotan
399            - montone <unfixed> (embed)
400    
401    NetXX
402            - monotone <unfixed> (embed)
403    
404    libgc
405            - mono <unfixed> (embed)
406    
407    lzma
408            - p7zip <unfixed> (embed)
409    
410    lzo
411            - grub2 <unfixed> (embed)
412    
413    yassl
414            - mysql-dfsg-5.0 <unfixed> (embed)
415    
416    pax code
417            - tar <unfixed> (embed)
418            - cpio <unfixed> (embed)
419    
420    t1lib
421            - tetex-bin 2.0.2-1 (embed)
422            - texlive-bin <unknown> (embed)
423    
424    guichan
425            - boswars <unfixed> (embed)
426            NOTE: maintainer notified us, working on it
427    
428    tolua
429            - boswars <unfixed> (embed)
430            NOTE: maintainer notified us, working on it
431    
432    asio-dev
433            - luxrender <unfixed> (embed)
434            NOTE: maintainer notified us, working on it
435            NOTE: may be merged with boost "soon"
436    
437  pax code:  xine-lib
438  tar          - vlc <unfixed> (embed)
439  cpio          NOTE: only parts included in modules/access/rtsp
440    
441  t1lib:  netpbm
442  tetex-bin (links to system t1lib since 2.0.2)          - tcl8.3 <unfixed> (embed)
443  texlive-bin (links to system t1lib)          - tcl8.4 <unfixed> (embed)
444            - tcl8.5 <unfixed> (embed)
445            NOTE: generic/tkImgGIF.c
446    
447    tk8.5
448            - tk8.0 <removed> (old-version)
449            - tk8.3 <unfixed> (old-version)
450            - tk8.4 <unfixed> (old-version)
451            - perl-tk <unfixable> (fork)
452    
453    samba
454            - mc <unfixed> (embed)
455            NOTE: maintainer is aware of this, currently searching a solution
456    
457    plib1.8.4c2
458            - boson <unfixed> (fork)
459            NOTE: embedding the font pieces of plib, based on the header file it is forked, contains "Added by AB for boson." and similar
460    
461    fribidi
462            - quesoglc <unfixed> (embed)
463    
464    glew
465            - quesoglc <unfixed> (embed)
466    
467    minorGems
468            - transcend <unfixed> (embed)
469            - cultivation <unfixed> (embed)
470    
471    libarchive
472            - tar <unfixed> (embed)
473            NOTE: FreeBSD tar (tar/bsdtar.c) in libarchive 1.2 and higher. libarchive ends up statically linked into bsdtar executable
474            - cpio <unfixed> (embed)
475            NOTE: cpio included in libarchive 2.2 and higher, but not compiled until libarchive 2.4.11-1 (as bsdcpio package)
476    
477    webkit
478            - qt4-x11 <unfixed> (embed)

Legend:
Removed from v.7743  
changed lines
  Added in v.8587

  ViewVC Help
Powered by ViewVC 1.1.5