/ 
Tk402.002
/ Tk::Xrm
Security Advisories (4)
CVE-2006-4484 (2008-10-01)

Buffer overflow in the LWZReadByte_ function in the GD extension in allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array.

CVE-2007-4769 (2008-01-09)

The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (backend crash) via an out-of-bounds backref number.

CVE-2007-4772 (2008-01-09)

The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted regular expression.

CVE-2007-6067 (2008-01-09)

Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (memory consumption) via a crafted "complex" regular expression with doubly-nested states.

NAME

Tk::Xrm - X Resource/Defaults/Options routines that obey the rules.

SYNOPSIS

use Tk;
use Tk::Xrm;

DESCRIPTION

Using this modules causes Tk's Option code to be replaced by versions which use routines from <X11/Xresource.h> - i.e. same ones every other X toolkit uses.

Result is that "matching" of name/Class with the options database follows the same rules as other X toolkits. This makes it more predictable, and makes it easier to have a single ~/.Xdefaults file which gives sensible results for both Tk and (say) Motif applications.

BUGS

Currently optionAdd('key' = 'value' [, priority])> ignores optional priority completely and just does XrmPutStringResource(). Perhaps it should be more subtle and do XrmMergeDatabases() or XrmCombineDatabase().

This version is a little slower than Tk's re-invention but there is more optimization that can be done.