There's a merged pull request on the void-packages repository

pango: fix CVE-2019-1010238.
https://github.com/void-linux/void-packages/pull/17740

Description:
None