Based on our discussion, closing this as NOTABUG. Please see https://bugzilla.redhat.com/show_bug.cgi?id=1124500#c5 for explanation on why we don't think this is not a security issue in cairo and why we wont fix this issue in Red Hat Enterprise Linux 6.