The list of packages embedding code from other projects is maintained in the secure-testing svn repository:

http://svn.debian.org/wsvn/secure-testing/data/embedded-code-copies?op=file

Send suggestions or additions to

mailto:secure-testing-team@lists.alioth.debian.org