I'm not able to add steinberg-bravura-fonts here, because that build is already in another update. I don't expect this update to go to stable anytime soon and I think that for such a big update it's sane to wait at least a week so it should be okay.
I backported those changes from RHEL, where I adressed CVEs mentioned in changelog and I was a bit lazy to check what CVEs has been already adressed in Fedora (my fault). I first added all CVEs mentioned in the changelog and then I went through some CVEs in bugzilla and added related ones (e.g. those in PrintStructures() which are under multiple CVEs from what I remember.