Arch Linux

Description:

Compiling ImageMagick with "--without-gslib" would mean that instead of using ghostscript libraries it will invoke "gs" executable to access ghostscript. This will allow to block ghostscript access in default config in easier way like:

<policy domain="delegate" rights="none" pattern="gs" />

instead of current rule:

<policy domain="coder" rights="none" pattern="{PS,PS2,PS3,EPS,PDF,XPS}" />

which has the downside of blocking PDF manipulation even when specific file doesn't contain any postscript content.

That will make default rules less invasive for users while keeping same amount of security (blocking ghostscript).

Additional info:
https://www.openwall.com/lists/oss-security/2018/08/23/12