xterm -ti vt340 &Announcement: GNOME will have an Outreachy intern working on librsvg
We are excited to announce that the GNOME Foundation is sponsoring an Outreachy internship for the December-March round!
The intern will work with mentor Federico Mena Quintero on the project, “Implement the SVG2 text layout algorithm in librsvg.”
The intern’s blog will soon be added to Planet GNOME, where you can follow their project updates and learn more about them. Stay tuned!
https://feborg.es/announcement-gnome-outreachy-librsvg-december-2024/
#AWS keys and user cookie #leakage via uninitialized memory leak in outdated #librsvg version in #Basecamp
(Cool report, just don’t mind the swear words, they’re not in English anyway 🤷 )
Basecamp supports uploading SVG pictures as avatars. Apparently, they are converted via an outdated librsvg version at Basecamp's servers. This version contains a vulnerability that allows leakage of the contents of an uninitialized memory block (that is, something is malloced, never initialized, and then used to build the preview image). Since it seems to be performed in the same unix process...
# TOTAL: 666
# PASS: 666
Nice. #librsvg
# TOTAL: 663
# PASS: 659
# SKIP: 0
# XFAIL: 0
# FAIL: 3
While fixing something else I broke markers - fixed them again. We really need to get rid of the weird offsetting code.
The failing tests: two are because of Use with Mask is broken (recursive mask instancing). One is because the Marker element starts with different default property values than the rest, and we don't handle that yet.