Imagemagick: potential exploit through ghost script in image magick

[dineshkannaa]

does the image magick uses ghostscript ,if so is it possible for a unauntheticated user to perform operations as mentioned here .
https://www.kb.cert.org/vuls/id/332928

a remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Ghostscript code.

and how to prevent it ?

[dlemstra]

ImageMagick best practices strongly encourages you to configure a security policy that suits your local environment. See https://www.imagemagick.org/script/security-policy.php for a detailed discussion. Relevant to this potential exploit in Ghostscript, you can restrict ImageMagick to only web-safe image formats with these policies:

<policy domain="delegate" rights="none" pattern="*" />
<policy domain="coder" rights="none" pattern="*" />
<policy domain="coder" rights="read | write" pattern="{GIF,JPEG,PNG,WEBP}" />

If you just want to disable Ghostscript, use this policy:

<policy domain="coder" rights="none" pattern="{PS2,PS3,PS,EPS,PDF,XPS}" />

Its possible that older versions of ImageMagick cannot process a glob pattern. If so, you can disable the formats one at at time, like this:

<policy domain="coder" rights="none" pattern="PS" />
<policy domain="coder" rights="none" pattern="PDF" />

Removing Ghostscript from your system is also a possible solution for your issue.