A remote code execution vulnerability in GNOME

I was about to reply to myself, after noticing that in the article. But that just goes to show that tightly sandboxing arbitrary code that wasn't specifically designed with that in mind is hard, and sometimes impossible.

I'm still not convinced the idea of automatically running parsers that evidently weren't designed to run in a completely locked down environment (if they were, the sandbox could be much tighter: e.g. only read and write on already open fds, and maybe brk with a low enough memory limit set via cgroups) on untrusted data is a good one.