diff --git a/tcl-8.4.15-regexp.patch b/tcl-8.4.15-regexp.patch
new file mode 100644
index 0000000..7da16ff
--- /dev/null
+++ b/tcl-8.4.15-regexp.patch
@@ -0,0 +1,71 @@
+--- tcl8.4.15/generic/regc_nfa.c.old	1999-08-05 03:16:57.000000000 +0200
++++ tcl8.4.15/generic/regc_nfa.c	2007-11-16 09:10:18.000000000 +0100
+@@ -803,6 +803,25 @@ struct arc *con;
+ 		return 1;
+ 	}
+ 
++	/*
++    * DGP 2007-11-15: Cloning a state with a circular constraint on its list
++    * of outs can lead to trouble [Bug 1810038], so get rid of them first.
++    */
++
++	for (a = from->outs; a != NULL; a = nexta) {
++		nexta = a->outchain;
++		switch (a->type) {
++			case '^':
++			case '$':
++			case BEHIND:
++			case AHEAD:
++				if (from == a->to) {
++			       freearc(nfa, a);
++       			}
++				break;
++		}
++    }
++
+ 	/* first, clone from state if necessary to avoid other outarcs */
+ 	if (from->nouts > 1) {
+ 		s = newstate(nfa);
+@@ -921,6 +940,29 @@ struct arc *con;
+ 		return 1;
+ 	}
+ 
++	/*
++	* DGP 2007-11-15: Here we duplicate the same protections as appear
++	* in pull() above to avoid troubles with cloning a state with a
++	* circular constraint on its list of ins.  It is not clear whether
++    * this is necessary, or is protecting against a "can't happen".
++    * Any test case that actually leads to a freearc() call here would
++    * be a welcome addition to the test suite.
++    */
++
++	for (a = to->ins; a != NULL; a = nexta) {
++		nexta = a->inchain;
++		switch (a->type) {
++			case '^':
++			case '$':
++			case BEHIND:
++			case AHEAD:
++				if (a->from == to) {
++					freearc(nfa, a);
++				}
++				break;
++		}
++	}
++
+ 	/* first, clone to state if necessary to avoid other inarcs */
+ 	if (to->nins > 1) {
+ 		s = newstate(nfa);
+--- tcl8.4.15/tests/regexp.test.old	2003-10-14 20:22:10.000000000 +0200
++++ tcl8.4.15/tests/regexp.test	2007-11-16 09:11:13.000000000 +0100
+@@ -628,6 +628,10 @@ test regexp-21.13 {multiple matches hand
+     regexp -all -inline -indices -line -- ^ "a\nb\nc"
+ } {{0 -1} {2 1} {4 3}}
+ 
++test regexp-22.1 {Bug 1810038} {
++    regexp ($|^X)* {}
++} 1
++
+ # cleanup
+ ::tcltest::cleanupTests
+ return
diff --git a/tcl.spec b/tcl.spec
index 95d82a6..ce2bb6b 100644
--- a/tcl.spec
+++ b/tcl.spec
@@ -3,7 +3,7 @@
 Summary: Tcl scripting language development environment
 Name: tcl
 Version: %{majorver}.15
-Release: 5%{?dist}
+Release: 6%{?dist}
 Epoch: 1 
 License: TCL
 Group: Development/Languages
@@ -16,6 +16,7 @@ Provides: tcl(abi) = %{majorver}
 ##Conflicts: tcldict
 Patch1: tcl-confi.patch
 Patch2: tcl-8.4.7-path.patch
+Patch3: tcl-8.4.15-regexp.patch
 
 %description
 The Tcl (Tool Command Language) provides a powerful platform for
@@ -59,6 +60,7 @@ chmod -x generic/tclThreadAlloc.c
 
 %patch1 -p1 -b .confi
 %patch2 -p1 -b .path
+%patch3 -p1 -b .regexp
 
 %build
 cd %{name}%{version}/unix
@@ -142,6 +144,10 @@ rm -rf $RPM_BUILD_ROOT
 %doc %{name}%{version}/html/*
 
 %changelog
+* Fri Nov 16 2007 Marcela Maslanova <mmaslano@redhat.com> - 1:8.4.15-6
+- CVE-2007-4772 NFA optimization cause hang in loop. Back ported patch
+	from upstream development version.
+
 * Wed Sep 26 2007 Marcela Maslanova <mmaslano@redhat.com> - 1:8.4.15-5
 - fix of patch - set auto_path was broken
 - Resolves: rhbz#306321