librsvg 2.40.21

[Federico Mena Quintero <install-module master gnome org>]

About librsvg
=============

Librsvg takes SVG documents and renders them into Cairo contexts. It
is used throughout GNOME to render things like scalable icons, in
image viewers to view SVGs easily, or to generate thumbnails for SVG
files. Other projects like Wikimedia and ImageMagick use librsvg for
their SVG rendering needs. Librsvg exports its API through GObject
Introspection, so bindings for other programming languages can be
created for it in an automated fashion.

News
====

- CVE-2019-20446 - Backport the following fixes from 2.46.x:

- #515 - Librsvg now has limits on the number of loaded XML elements,
  and the number of referenced elements within an SVG document.  This
  is to mitigate malicious SVGs which try to consume all memory, and
  those which try to consume an exponential amount of CPU time.

- #308 - Fix stack exhaustion with circular references in <use> elements.

- #323 - Fix a denial-of-service condition from exponential explosion
  of rendered elements, through nested use of SVG "use" elements in
  malicious SVGs.  This is similar to the XML "billion laughs attack"
  but for SVG instancing.



Download
========
https://download.gnome.org/sources/librsvg/2.40/librsvg-2.40.21.tar.xz (1.58M)
  sha256sum: f7628905f1cada84e87e2b14883ed57d8094dca3281d5bcb24ece4279e9a92ba