cairo CVE-2018-19876
There is a cairo bug causing crashes in WebKit and upstream has been unresponsive, so I cynically requested a CVE hoping that would prompt a response. Didn't work, but now we have a CVE for it at least.
Can you please add this patch:
https://gitlab.freedesktop.org/cairo/cairo/merge_requests/5.patch
Note it won't be found by our CVE checker; @tingping says the NVD doesn't have it tagged appropriately, or something like that. Whatever, just illustrates the importance of upstream release monitoring in addition to CVE checks. (Admittedly, neither would have caught this....)