aptitude hold itcl3 itk3 iwidgets4 tcl8.3 tclx8.3 tclshThis seems to work in preventing aptitude from upgrading those packages, but it doesn't prevent Update Manager from upgrading them. To prevent this, you can do the following.
aptitude -y install wajig
wajig hold itcl3 itk3 iwidgets4 tcl8.3 tclx8.3 tclshIf you've already run Update Manager and Sguil is currently broken, do the following to revert to the required versions.
aptitude remove tcl8.5 itcl3 tk8.5 itk3 iwidgets4
This will be fixed in the next version of Security Onion.