Red Hat Security Advisory

RHSA-2008:0134

tcltk security update

Released 2008-02-21 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Desktop version 3 expect-5.38.0-92.8, expect-5.38.0-92.8.i386, expect-devel-5.38.0-92.8 +16
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 expect-5.38.0-75.i386, expect-5.38.0-75.ia64, itcl-3.2-75.i386 +12
Red Hat Enterprise Linux AS version 3 expect-5.38.0-92.8, expect-5.38.0-92.8.i386, expect-5.38.0-92.8.ia64 +34
Red Hat Enterprise Linux ES version 2.1 expect-5.38.0-75.i386, itcl-3.2-75.i386, tcl-8.3.3-75.i386 +5
Red Hat Enterprise Linux ES version 3 expect-5.38.0-92.8, expect-5.38.0-92.8.i386, expect-5.38.0-92.8.ia64 +25
Red Hat Enterprise Linux WS version 2.1 expect-5.38.0-75.i386, itcl-3.2-75.i386, tcl-8.3.3-75.i386 +5
Red Hat Enterprise Linux WS version 3 expect-5.38.0-92.8, expect-5.38.0-92.8.i386, expect-5.38.0-92.8.ia64 +25
Red Hat Linux Advanced Workstation 2.1 expect-5.38.0-75.ia64, itcl-3.2-75.ia64, tcl-8.3.3-75.ia64 +5

Fixes 3 records

TI-2008-00525 CVE-2008-0553 · GHSA-w2px-74cm-hrpr

Stack-based buffer overflow in the ReadImage function in tkImgGIF.c in Tk (Tcl/Tk) before…

LOW 37

Stack-based buffer overflow in the ReadImage function in tkImgGIF.c in Tk (Tcl/Tk) before 8.5.1 allows remote attackers to execute arbitrary code via a crafted GIF image, a similar issue to CVE-2006-4484.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.04246 Published 2008-02-07 Fixed CWE-119

TI-2007-05165 CVE-2007-5378 · GHSA-5mgp-v92x-h349

Buffer overflow in the FileReadGIF function in tkImgGIF.c for Tk Toolkit 8.4.12 and…

LOW 25

Buffer overflow in the FileReadGIF function in tkImgGIF.c for Tk Toolkit 8.4.12 and earlier, and 8.3.5 and earlier, allows user-assisted attackers to cause a denial of service (segmentation fault) via an animated GIF in…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02643 Published 2007-10-12 Fixed CWE-119

TI-2007-04619 CVE-2007-4772 · GHSA-x3q3-v77f-cg26

The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before…

LOW 25

The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows context-dependent attackers to cause a denial of service (in…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.03812 Published 2008-01-09 Partial fix CWE-399