GNU bug report logs - #33587
[PROPOSED] Default to disabling ImageMagick

Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.

Package: emacs; Reported by: Paul Eggert <eggert@HIDDEN>; Keywords: security; dated Sun, 2 Dec 2018 18:10:02 UTC; Maintainer for emacs is bug-gnu-emacs@HIDDEN.
Added tag(s) security. Request was from Glenn Morris <rgm@HIDDEN> to control <at> debbugs.gnu.org. Full text available.

Message received at 33587 <at> debbugs.gnu.org:


Received: (at 33587) by debbugs.gnu.org; 2 Dec 2018 18:17:44 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sun Dec 02 13:17:44 2018
Received: from localhost ([127.0.0.1]:58347 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1gTWJK-0006iZ-Ld
	for submit <at> debbugs.gnu.org; Sun, 02 Dec 2018 13:17:44 -0500
Received: from eggs.gnu.org ([208.118.235.92]:57160)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <eliz@HIDDEN>) id 1gTWJJ-0006iM-4p
 for 33587 <at> debbugs.gnu.org; Sun, 02 Dec 2018 13:17:41 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <eliz@HIDDEN>) id 1gTWJ9-00063T-U0
 for 33587 <at> debbugs.gnu.org; Sun, 02 Dec 2018 13:17:35 -0500
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=disabled
 version=3.3.2
Received: from fencepost.gnu.org ([2001:4830:134:3::e]:33484)
 by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from <eliz@HIDDEN>)
 id 1gTWH1-0004wU-9c; Sun, 02 Dec 2018 13:15:19 -0500
Received: from [176.228.60.248] (port=2567 helo=home-c4e4a596f7)
 by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256)
 (Exim 4.82) (envelope-from <eliz@HIDDEN>)
 id 1gTWH0-0007MP-Tb; Sun, 02 Dec 2018 13:15:19 -0500
Date: Sun, 02 Dec 2018 20:15:07 +0200
Message-Id: <83va4baj84.fsf@HIDDEN>
From: Eli Zaretskii <eliz@HIDDEN>
To: Paul Eggert <eggert@HIDDEN>
In-reply-to: <20181202180919.32270-1-eggert@HIDDEN> (message from Paul
 Eggert on Sun, 2 Dec 2018 10:09:19 -0800)
Subject: Re: bug#33587: [PROPOSED] Default to disabling ImageMagick
References: <20181202180919.32270-1-eggert@HIDDEN>
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
X-Received-From: 2001:4830:134:3::e
X-Spam-Score: -5.0 (-----)
X-Debbugs-Envelope-To: 33587
Cc: 33587 <at> debbugs.gnu.org, eggert@HIDDEN
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -6.0 (------)

> From: Paul Eggert <eggert@HIDDEN>
> Date: Sun,  2 Dec 2018 10:09:19 -0800
> Cc: Paul Eggert <eggert@HIDDEN>
> 
> From: Paul Eggert <eggert@HIDDEN>
> 
> ImageMagick has continuing stability and security problems, suggesting
> that 'configure' should disable it by default.  See Glenn Morris's notes
> at: https://lists.gnu.org/r/emacs-devel/2018-12/msg00036.html
> * INSTALL, etc/NEWS: Mention this.
> * configure.ac (imagemagick): Default to off.

No objections from me, but let's please wait for a week, to let people
chance to voice objections.

Thanks.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#33587; Package emacs. Full text available.

Message received at submit <at> debbugs.gnu.org:


Received: (at submit) by debbugs.gnu.org; 2 Dec 2018 18:09:44 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sun Dec 02 13:09:44 2018
Received: from localhost ([127.0.0.1]:58336 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1gTWBb-0006Vt-7m
	for submit <at> debbugs.gnu.org; Sun, 02 Dec 2018 13:09:43 -0500
Received: from eggs.gnu.org ([208.118.235.92]:54870)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <eggert@HIDDEN>) id 1gTWBZ-0006Ve-5U
 for submit <at> debbugs.gnu.org; Sun, 02 Dec 2018 13:09:41 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <eggert@HIDDEN>) id 1gTWBT-0000TS-7f
 for submit <at> debbugs.gnu.org; Sun, 02 Dec 2018 13:09:36 -0500
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50 autolearn=disabled
 version=3.3.2
Received: from lists.gnu.org ([2001:4830:134:3::11]:56357)
 by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
 (Exim 4.71) (envelope-from <eggert@HIDDEN>) id 1gTWBT-0000TN-3C
 for submit <at> debbugs.gnu.org; Sun, 02 Dec 2018 13:09:35 -0500
Received: from eggs.gnu.org ([2001:4830:134:3::10]:36231)
 by lists.gnu.org with esmtp (Exim 4.71)
 (envelope-from <eggert@HIDDEN>) id 1gTWBQ-0007Qn-RA
 for bug-gnu-emacs@HIDDEN; Sun, 02 Dec 2018 13:09:34 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <eggert@HIDDEN>) id 1gTWBM-0000R8-0V
 for bug-gnu-emacs@HIDDEN; Sun, 02 Dec 2018 13:09:32 -0500
Received: from zimbra.cs.ucla.edu ([131.179.128.68]:45038)
 by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32)
 (Exim 4.71) (envelope-from <eggert@HIDDEN>) id 1gTWBL-0000QT-RC
 for bug-gnu-emacs@HIDDEN; Sun, 02 Dec 2018 13:09:27 -0500
Received: from localhost (localhost [127.0.0.1])
 by zimbra.cs.ucla.edu (Postfix) with ESMTP id 312201600A9
 for <bug-gnu-emacs@HIDDEN>; Sun,  2 Dec 2018 10:09:26 -0800 (PST)
Received: from zimbra.cs.ucla.edu ([127.0.0.1])
 by localhost (zimbra.cs.ucla.edu [127.0.0.1]) (amavisd-new, port 10032)
 with ESMTP id ufVCTaJw-_NF; Sun,  2 Dec 2018 10:09:23 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
 by zimbra.cs.ucla.edu (Postfix) with ESMTP id 9C8F4160260;
 Sun,  2 Dec 2018 10:09:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at zimbra.cs.ucla.edu
Received: from zimbra.cs.ucla.edu ([127.0.0.1])
 by localhost (zimbra.cs.ucla.edu [127.0.0.1]) (amavisd-new, port 10026)
 with ESMTP id cXkClDPIg1os; Sun,  2 Dec 2018 10:09:23 -0800 (PST)
Received: from Penguin.CS.UCLA.EDU (Penguin.CS.UCLA.EDU [131.179.64.200])
 by zimbra.cs.ucla.edu (Postfix) with ESMTPSA id 79EE01600A9;
 Sun,  2 Dec 2018 10:09:23 -0800 (PST)
From: Paul Eggert <eggert@HIDDEN>
To: bug-gnu-emacs@HIDDEN
Subject: [PROPOSED] Default to disabling ImageMagick
Date: Sun,  2 Dec 2018 10:09:19 -0800
Message-Id: <20181202180919.32270-1-eggert@HIDDEN>
X-Mailer: git-send-email 2.19.2
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy]
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x
X-Received-From: 2001:4830:134:3::11
X-Spam-Score: -4.0 (----)
X-Debbugs-Envelope-To: submit
Cc: Paul Eggert <eggert@HIDDEN>
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -5.0 (-----)

From: Paul Eggert <eggert@HIDDEN>

ImageMagick has continuing stability and security problems, suggesting
that 'configure' should disable it by default.  See Glenn Morris's notes
at: https://lists.gnu.org/r/emacs-devel/2018-12/msg00036.html
* INSTALL, etc/NEWS: Mention this.
* configure.ac (imagemagick): Default to off.
---
 INSTALL      | 4 +++-
 configure.ac | 2 +-
 etc/NEWS     | 4 ++++
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/INSTALL b/INSTALL
index 0c56fff6d4..9696904dce 100644
--- a/INSTALL
+++ b/INSTALL
@@ -294,7 +294,9 @@ or more of these options:
   --without-gif          for GIF image support
   --without-png          for PNG image support
   --without-rsvg         for SVG image support
-  --without-imagemagick  for Imagemagick support
+
+Although ImageMagick support is disabled by default due to security
+and stability concerns, you can enable it with --with-imagemagick.
=20
 Use --without-toolkit-scroll-bars to disable Motif or Xaw3d scroll bars.
=20
diff --git a/configure.ac b/configure.ac
index 8b34c3b658..b70393925a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -354,7 +354,7 @@ AC_DEFUN
 OPTION_DEFAULT_ON([libsystemd],[don't compile with libsystemd support])
 OPTION_DEFAULT_OFF([cairo],[compile with Cairo drawing (experimental)])
 OPTION_DEFAULT_ON([xml2],[don't compile with XML parsing support])
-OPTION_DEFAULT_ON([imagemagick],[don't compile with ImageMagick image su=
pport])
+OPTION_DEFAULT_OFF([imagemagick],[compile with ImageMagick image support=
])
 OPTION_DEFAULT_ON([json], [don't compile with native JSON support])
=20
 OPTION_DEFAULT_ON([xft],[don't use XFT for anti aliased fonts])
diff --git a/etc/NEWS b/etc/NEWS
index 6297d07879..07c6f74c44 100644
--- a/etc/NEWS
+++ b/etc/NEWS
@@ -37,6 +37,10 @@ functions 'json-serialize', 'json-insert', 'json-parse=
-string', and
 'json-parse-buffer' are typically much faster than their Lisp
 counterparts from json.el.
=20
+** Emacs no longer defaults to using ImageMagick to display images,
+due to security and stability concerns.  To override the default, use
+'configure --with-imagemagick'.
+
 ** The etags program now uses the C library's regular expression matcher
 when possible, and a compatible regex substitute otherwise.  This will
 let developers maintain Emacs's own regex code without having to also
--=20
2.19.2





Acknowledgement sent to Paul Eggert <eggert@HIDDEN>:
New bug report received and forwarded. Copy sent to bug-gnu-emacs@HIDDEN. Full text available.
Report forwarded to bug-gnu-emacs@HIDDEN:
bug#33587; Package emacs. Full text available.
Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.
Last modified: Sun, 2 Dec 2018 19:00:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.