Indeed. Somewhat related, but here's Debian's list of embedded code copies:

https://anonscm.debian.org/viewvc/secure-testing/data/embedd...

Lots of these have colourful/active security histories (esp. poppler, zlib, pcre, libpng...)