{"id":"CVE-2021-35331","aliases":["BELL-CVE-2021-35331","DEBIAN-CVE-2021-35331","EUVD-2021-21974","GHSA-539q-24vg-qfm4","OESA-2022-1720","ROOT-OS-DEBIAN-12-CVE-2021-35331","SUSE-FU-2022:0484-1","SUSE-FU-2022:0868-1"],"status":"disputed","title":"** DISPUTED ** In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code...","description":"In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of this finding","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01689,"percentile":0.77189,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-134"],"published":"2021-07-05T14:59:29Z","modified":"2026-10-23T18:03:14Z","fixes":[{"ecosystem":"openEuler:20.03-LTS-SP1","package":"tcl","fixed_in":["8.6.10-4.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"tcl","fixed_in":["8.6.10-4.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"tcl","fixed_in":["8.6.10-4.oe2203"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"tcl8.6","fixed_in":["8.6.13+dfsg-2.root.io.2","8.6.13+dfsg-2.root.io.1","8.6.13+dfsg-2.aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-tcl8.6","fixed_in":["8.6.13+dfsg-2.root.io.2","8.6.13+dfsg-2.root.io.1","8.6.13+dfsg-2.aikido.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"tcl","fixed_in":["8.6.12-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"tk","fixed_in":["8.6.12-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tcl","fixed_in":["8.6.12-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tk","fixed_in":["8.6.12-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tcl","fixed_in":["8.6.12-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tk","fixed_in":["8.6.12-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"tcl","fixed_in":["8.6.12-150300.14.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"tk","fixed_in":["8.6.12-150300.10.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"tk","fixed_in":["8.6.12-150300.10.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"tcl8.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.6.13+dfsg-2","8.6.14+dfsg-1","8.6.15+dfsg-1","8.6.15+dfsg-2","8.6.16+dfsg-1","8.6.17+dfsg-1","8.6.18+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"tcl8.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.6.16+dfsg-1","8.6.17+dfsg-1","8.6.18+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"tcl8.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.6.16+dfsg-1","8.6.17+dfsg-1","8.6.18+dfsg-1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.10-4.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.10-4.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.10-4.oe2203"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"tcl8.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.13+dfsg-2.root.io.2"},{"fixed":"8.6.13+dfsg-2.root.io.1"},{"fixed":"8.6.13+dfsg-2.aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-tcl8.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.13+dfsg-2.root.io.2"},{"fixed":"8.6.13+dfsg-2.root.io.1"},{"fixed":"8.6.13+dfsg-2.aikido.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.12-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"tk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.12-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.12-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.12-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.12-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.12-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.12-150300.14.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"tk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.12-150300.10.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"tk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.12-150300.10.3.1"}]}]}],"products":[{"vendor":"tcl","product":"tcl"}],"references":[{"url":"https://core.tcl-lang.org/tcl/info/bad6cc213dfe8280","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","evidence"]},{"url":"https://core.tcl-lang.org/tcl/info/28ef6c0c741408a2","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Vendor Advisory","fix"]},{"url":"https://github.com/tcltk/tcl/commit/4705dbdde2f32ff90420765cd93e7ac71d81a222","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://sqlite.org/forum/info/7dcd751996c93ec9","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35331","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-539q-24vg-qfm4"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-35331","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-35331","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1720","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2022-484/suse-fu-20220484-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1072657","tags":["report"]},{"url":"https://bugzilla.suse.com/1085480","tags":["report"]},{"url":"https://bugzilla.suse.com/1138797","tags":["report"]},{"url":"https://bugzilla.suse.com/1179615","tags":["report"]},{"url":"https://bugzilla.suse.com/1181840","tags":["report"]},{"url":"https://bugzilla.suse.com/1185662","tags":["report"]},{"url":"https://bugzilla.suse.com/1195257","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35331","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/-2022-868/suse-fu-20220868-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/903017","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-35331","description":"In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of this finding","status":"disputed","published":"2021-07-05T14:59:29Z","modified":"2024-08-04T00:33:51.273Z","updated_at":"2026-11-02T14:33:09.864034Z"}],"euvd":[{"id":"EUVD-2021-21974","description":"In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of this finding","status":"published","published":"2021-07-05T14:59:29Z","modified":"2024-08-04T00:33:51Z","updated_at":"2026-11-03T03:24:30.441845Z"}],"ghsa":[{"id":"GHSA-539q-24vg-qfm4","title":"** DISPUTED ** In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code...","description":"** DISPUTED ** In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crated file. NOTE: multiple third parties dispute the significance of this finding.","status":"published","published":"2022-05-24T19:06:55Z","modified":"2024-03-30T05:01:45Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:55:45.190481Z"}],"nvd":[{"id":"CVE-2021-35331","description":"In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of this finding","status":"disputed","published":"2021-07-05T15:15:07.997Z","modified":"2026-06-17T03:57:26.75Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:06:55.259633Z"}],"osv":[{"id":"BELL-CVE-2021-35331","title":"CVE-2021-35331 does not affect BellSoft software","status":"withdrawn","published":"2021-07-05T15:15:00Z","modified":"2026-01-26T09:49:33.120635Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-35331","description":"In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of this finding","status":"published","published":"2021-07-05T15:15:07.997Z","modified":"2026-10-20T14:28:26.447466717Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"DEBIAN-CVE-2021-35331","description":"In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of this finding","status":"published","published":"2021-07-05T15:15:07.997Z","modified":"2026-10-23T18:03:14.294764937Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"OESA-2022-1720","title":"tcl security update","description":"Tcl(Tool Command Language) provides a powerful platform for creating integration applications that tie together diverse applications, protocols, devices, and frameworks. When paired with the Tk toolkit, Tcl provides the fastest and most powerful way to create GUI applications that run on linux, Unix, and Mac OS X. Tcl can also be used for a variety of web-related tasks and for creating powerful command languages for applications.\r\n\r\nSecurity Fix(es):\r\n\r\n** DISPUTED ** In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of this finding.(CVE-2021-35331)","status":"published","published":"2022-06-24T11:04:59Z","modified":"2026-08-18T01:16:41.276571401Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2021-35331","title":"CVE-2021-35331 in tcl8.6 - Patched by Root","description":"Root has patched CVE-2021-35331 in the tcl8.6 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T14:07:26Z","modified":"2026-08-26T01:13:59.697268727Z","updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"SUSE-FU-2022:0484-1","title":"Feature update for tcl and tk","description":"This feature update for tcl and tk fix the following issues:\n\nUpdate tcl and tk to version 8.6.12 (jsc#SLE-21015, jsc#SLE-23283):\n\n- Move tcl.macros to /usr/lib/rpm/macros.d (bsc#1185662) \n- Use FAT LTO objects in order to provide proper static library (bsc#1138797)\n- Fix tcl build issues on s390 architecture (bnc#1085480)\n- Fix tcl build issues caused by deprecated libieee in tcl configs (bsc#1179615, bsc#1181840)\n- Whitelist PowerPC tests that are not needed  (bsc#1072657)\n- Add [combobox current] support 'end' index\n- Add fixes in [text] bindings\n- Add missing 'deferred clear code' support to GIF photo images\n- Add new virtual event \u003c\u003cTkWorldChanged\u003e\u003e \n- Add new keycodes: CodeInput, SingleCandidate, MultipleCandidate, PreviousCandidate\n- Add new support for POSIX error: EILSEQ\n- Add new command [tcl::unsupported::corotype]\n- Add new command [tcl::unsupported::timerate] for performance testing\n- Add new option -state to [ttk::scale]\n- Add portable keycodes: OE, oe, Ydiaeresis\n- Add support for backrefs in [array names -regexp]\n- Add support for Unicode 14\n- Disfavor Master/Slave terminology\n- Enhance [oo::object] to acquire or lose a class identity dynamically\n- Fix canvas rotated text overlap detection\n- Fix canvas closed polylines yo fully honor -joinstyle\n- Fix display of Long non-wrapped lines in text\n- Fix display treeview focus ring when -selectmode none\n- Fix focus events not to break entry validation\n- Fix [package prefer stable] failing case\n- Fix auto_path initialization by Safe Base interps\n- Fix bad interaction between grab and mouse pointer warp\n- Fix borderwidth calculations on menu items\n- Fix cascade tearoff menu redraw artifacts\n- Fix coords rounding when drawing canvas items\n- Fix corrupt result from [$c postscript] with -file or -channel\n- Fix errno management in socket full close\n- Fix failure when a [proc] argument name is computed, not literal\n- Fix focus on unmapped windows\n- Fix handling of duplicates in spinbox -values list\n- Fix incomplete read of multi-image GIF\n- Fix initialization order of static package in wish \n- Fix issue when trying to display angled text without Xft\n- Fix issue with font initialization when no font is installed\n- Fix problems with Noto Color Emoji font\n- Fix race conditions in [file delete] and [file mkdir]\n- Fix Std channel initialization for multi-thread operations\n- Fix tearoff menu redraw artifacts\n- Fix up arrow key in [text] to correctly move cursor to index 1.0\n- Fix various cursor issues\n- Fix various encoding issues\n- Fix various fontchooser issues\n- Fix various issues causing crashes and hang in\n- Fix various memory issues\n- Fix various scrolling bugs and add improvements\n- Fix 32/64-bit confusion of FS DIR operations reported for AIX\n- Improve appearance of text selection in [*entry] widgets\n- Improve checkbutton handling of -selectcolor\n- Improve handling of resolution changes\n- Improve multi-thread safety when Xft is in use \n- Improve ttk high-contrast-mode support\n- Improve emoji support\n- Improve legacy support for [tk_setPalette]\n- Make combobox -postoffset option work with default style\n- Make spinbox use proper names in query of option database\n- Menu flaws when empty menubar clicked\n- New index argument in [$menubutton post x y index]\n- Preserve canvas tag list order during add/delete\n- Prevent cross-manager loops of geom management\n- Rewrite of zlib inflation for multi-stream and completeness\n- Run fileevents in proper thread after [thread::attach $channel]\n- Stop [unload] corruption of list of loaded packages\n- Stop app switching exposing withdrawn windows as zombies\n- Tk now denied access to PRIMARY selection from safe interps\n- TkpDrawAngledCharsInContext leaked a CGColor\n- Try to restore Tcl's [update] command when Tk is unloaded\n- Changed [info * methods] to include mixins\n- [package require] is now NR-enabled\n\nThe following fixes might show some potential incompatibilities with existing software:\n\n- Revised [binary (en|de)code base64] for RFC compliance and roundtrip\n- Fix precision of Tcl_DStringAppendElement quoting of #\n- Extended [clock scan] ISO format and time zone support\n- Allow for select/copy from disabled text widget on all platforms\n- Revised case of [info loaded] module names\n- [info hostname] reports DNS name, not NetBIOS name\n- Force -eofchar \\032 when evaluating library scripts\n- Revised error messages: 'too few' =\u003e 'not enough'\n- Performed rewrite of Tk event loop to prevent ring overflow\n- Refactored all MouseWheel bindings\n- Revised precision of ::scale widget tick mark values\n- Prevent transient window cycles (crashed on Aqua)\n- Builds no longer use -lieee\n- Quoting of command line arguments by [exec] on Windows revised. Prior\n  quoting rules left holes where some values would not pass through, but\n  could trigger substitutions or program execution. See\n  https://core.tcl-lang.org/tcl/info/21b0629c81 \n- [lreplace] accepts all out-of-range index values\n","status":"published","published":"2022-02-18T03:29:03Z","modified":"2026-02-04T04:30:20.743489Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-FU-2022:0868-1","title":"Feature update for tcl and tk","description":"This feature update for tcl and tk fixes the following issues:\n\nUpdate tcl and tk to version 8.6.12 (jsc#SLE-21016, jsc#SLE-23284):\n\n- Move tcl.macros to /usr/lib/rpm/macros.d (bsc#1185662) \n- Use FAT LTO objects in order to provide proper static library (bsc#1138797)\n- Fix a bug in itcl that was affecting iwidgets (bsc#903017)\n- Add [combobox current] support 'end' index\n- Add fixes in [text] bindings\n- Add missing 'deferred clear code' support to GIF photo images\n- Add new virtual event \u003c\u003cTkWorldChanged\u003e\u003e \n- Add new keycodes: CodeInput, SingleCandidate, MultipleCandidate, PreviousCandidate\n- Add new support for POSIX error: EILSEQ\n- Add new command [tcl::unsupported::corotype]\n- Add new command [tcl::unsupported::timerate] for performance testing\n- Add new option -state to [ttk::scale]\n- Add portable keycodes: OE, oe, Ydiaeresis\n- Add support for backrefs in [array names -regexp]\n- Add support for Unicode 14\n- Disfavor Master/Slave terminology\n- Enhance [oo::object] to acquire or lose a class identity dynamically\n- Fix canvas rotated text overlap detection\n- Fix canvas closed polylines yo fully honor -joinstyle\n- Fix display of Long non-wrapped lines in text\n- Fix display treeview focus ring when -selectmode none\n- Fix focus events not to break entry validation\n- Fix [package prefer stable] failing case\n- Fix auto_path initialization by Safe Base interps\n- Fix bad interaction between grab and mouse pointer warp\n- Fix borderwidth calculations on menu items\n- Fix cascade tearoff menu redraw artifacts\n- Fix coords rounding when drawing canvas items\n- Fix corrupt result from [$c postscript] with -file or -channel\n- Fix errno management in socket full close\n- Fix failure when a [proc] argument name is computed, not literal\n- Fix focus on unmapped windows\n- Fix handling of duplicates in spinbox -values list\n- Fix incomplete read of multi-image GIF\n- Fix initialization order of static package in wish \n- Fix issue when trying to display angled text without Xft\n- Fix issue with font initialization when no font is installed\n- Fix problems with Noto Color Emoji font\n- Fix race conditions in [file delete] and [file mkdir]\n- Fix Std channel initialization for multi-thread operations\n- Fix tearoff menu redraw artifacts\n- Fix up arrow key in [text] to correctly move cursor to index 1.0\n- Fix various cursor issues\n- Fix various encoding issues\n- Fix various fontchooser issues\n- Fix various issues causing crashes and hang in\n- Fix various memory issues\n- Fix various scrolling bugs and add improvements\n- Fix 32/64-bit confusion of FS DIR operations reported for AIX\n- Improve appearance of text selection in [*entry] widgets\n- Improve checkbutton handling of -selectcolor\n- Improve handling of resolution changes\n- Improve multi-thread safety when Xft is in use \n- Improve ttk high-contrast-mode support\n- Improve emoji support\n- Improve legacy support for [tk_setPalette]\n- Make combobox -postoffset option work with default style\n- Make spinbox use proper names in query of option database\n- Menu flaws when empty menubar clicked\n- New index argument in [$menubutton post x y index]\n- Preserve canvas tag list order during add/delete\n- Prevent cross-manager loops of geom management\n- Rewrite of zlib inflation for multi-stream and completeness\n- Run fileevents in proper thread after [thread::attach $channel]\n- Stop [unload] corruption of list of loaded packages\n- Stop app switching exposing withdrawn windows as zombies\n- Tk now denied access to PRIMARY selection from safe interps\n- TkpDrawAngledCharsInContext leaked a CGColor\n- Try to restore Tcl's [update] command when Tk is unloaded\n- Changed [info * methods] to include mixins\n- [package require] is now NR-enabled\n\nThe following fixes might show some potential incompatibilities with existing software:\n\n- Revised [binary (en|de)code base64] for RFC compliance and roundtrip\n- Tcl_DStringAppendElement # quoting precision, dstring-2.13, dstring-3.10\n- Extended [clock scan] ISO format and time zone support\n- Allow for select/copy from disabled text widget on all platforms\n- Revised case of [info loaded] module names\n- [info hostname] reports DNS name, not NetBIOS name\n- Force -eofchar \\032 when evaluating library scripts\n- Revised error messages: 'too few' =\u003e 'not enough'\n- Performed rewrite of Tk event loop to prevent ring overflow\n- Refactored all MouseWheel bindings\n- Revised precision of ::scale widget tick mark values\n- Prevent transient window cycles (crashed on Aqua)\n- Builds no longer use -lieee\n- Quoting of command line arguments by [exec] on Windows revised. Prior\n  quoting rules left holes where some values would not pass through, but\n  could trigger substitutions or program execution. See\n  https://core.tcl-lang.org/tcl/info/21b0629c81 \n- [lreplace] accepts all out-of-range index values\n","status":"published","published":"2022-03-16T06:16:05Z","modified":"2026-02-04T03:20:44.591612Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}