[Secure-testing-team] Embedded code in mednafen and xmoto

[Stephen Kitt]

Hi,

I maintain mednafen and xmoto which ship other packages' source code.

mednafen includes:
* lzo2, not-affected since 0.8.D.3-4 and 0.9.17.1-1 (the source package
  includes minilzo but the binary package is built using the minilzo package
  instead)
* libvorbisidec, not-affected since 0.9.17.1-1 (as above)
* libmpcdec, not-affected since 0.9.21-1 (as above)

mednafen 0.8.D.3-4 and 0.8.D.3-5 attempted to use the packaged libvorbisidec,
but this breaks CD playback when using .ogg files (see #699143), so it's
likely that future packages in the 0.8 series will build using the embedded
code.

xmoto includes an old version of chipmunk, and can't easily be fixed. This is
tracked by #623299.

Regards,

Stephen
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20130130/ff8b0fa5/attachment.pgp>