From: "otto.cooper" <otto.cooper@proton.me>
Subject: Re: LunaSVG
To: ports@openbsd.org
Date: Sun, 30 Nov 2025 15:25:50 +0000

SVG is a risk vector.

How good is LunaSVG?

https://www.cloudflare.com/cloudforce-one/research/svgs-the-hackers-canvas/

https://cybersecuritynews.com/threat-actors-weaponizing-svg-files/

https://cybersecsentinel.com/malicious-svg-attachments-bypass-email-filters-in-widespread-phishing-campaigns/

https://undercodetesting.com/exploiting-svg-vulnerabilities-in-chrome-and-safari-a-cybersecurity-deep-dive/

https://www.infosecurity-magazine.com/news/hackers-svg-files-javascript/

-------- Original Message --------
On Sunday, 11/30/25 at 16:04 Kirill A. Korinsky <kirill@korins.ky> wrote:
On Sun, 30 Nov 2025 13:38:52 +0100,
"Anthony J. Bentley" <bentley@openbsd.org> wrote:
>
> [1  <text/plain; UTF-8 (quoted-printable)>]
> Hi,
>
> > > LunaSVG is an SVG rendering library in C++, designed to be lightweight and
> > > portable, offering efficient rendering and manipulation of Scalable Vector
> > > Graphics (SVG) files.
> > >
> > > LunaSVG supports nearly all graphical features outlined in the SVG 1.1 and
> > > SVG 1.2 Tiny specifications.
> > >
> > >
> > > This is needed for an update to emulators/es-de.
> > >
> > > ok?
> >
> > Ping.
>
> Ping.
>
> --
> Anthony J. Bentley
> [2 lunasvg.tar.gz <application/x-gzip (base64)>]

WANTLIB needs pthread:

lunasvg $ ldd /build/pobj/lunasvg-3.5.0/fake-amd64/usr/local/lib/*so* | grep pthread
/build/pobj/lunasvg-3.5.0/fake-amd64/usr/local/lib/liblunasvg.so.0.0: exit status 1
        00000d8f39e7c000 00000d8f39e89000 rlib  0    1   0      /usr/lib/libpthread.so.28.1
lunasvg $

with that OK kirill@ to import

P.S. feels that you had missed subject

--
wbr, Kirill