92

Each time I want to convert jpg file to pdf by this command

convert *.jpg pictures.pdf

I have this error message:

convert: not authorized `pictures.pdf' @ error/constitute.c/WriteImage/1028.
118

This problems comes from a security update: https://launchpad.net/ubuntu/+source/imagemagick/8:6.8.9.9-7ubuntu5.13

Someone reported it as a bug: https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1796563

As a temporary fix, I edited /etc/ImageMagick-6/policy.xml and changed the PDF rights from none to read|write there. Not sure about the implications, but at least it allows me to get things done.

| improve this answer | |
  • 1
    I looked into it again, and I'm almost certain that the security fix is related to kb.cert.org/vuls/id/332928 (which documents various ways to bypass -dSAFER in ghostscript). – YoungFrog Oct 9 '18 at 13:13
  • 3
    This indeed works as advertized. I simply commented out (effectively removed) the pdf-line. It would be good to know what the side-effects would be! The policymap in the config file comments that this is for "disable ghostscript format types". – Marten Koetsier Oct 22 '18 at 12:00
  • 1
  • 3
    I was hesitant to change the security settings. As an alternative to imagemagick I used "pdftoppm -jpeg input.pdf output.jpg" (from package named poppler-utils). This alternative was posted in bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1796563 – Vahid Pazirandeh Jan 18 '19 at 23:31
  • Change destination file format policy respectively <policy domain="coder" rights="read|write" pattern="PDF" /> .Usually they will be at the end .Thanks – yunus Apr 3 '19 at 9:20
23

Fixed this on my Ubuntu 16.04.6 LTS by following accepted answer.

Created simple sed one-liner to get this fixed faster:

sudo sed -i 's#<policy domain="coder" rights="none" pattern="PDF" />#<policy domain="coder" rights="read|write" pattern="PDF" />#' /etc/ImageMagick-6/policy.xml

and in programmatic way.

| improve this answer | |
7

If you're worried about the implications, https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1796563 mentions that

While the release notes are not exactly clear, Ghostscript v9.25 seems to make reference to fixing some vulnerabilities of this sort: https://www.ghostscript.com/doc/9.25/News.htm

| improve this answer | |
2

Disabling security limitations is a bad habit to get into. The ImageMagick authors presumably made this one for a reason. You should respect that, unless you know exactly what you are doing. That does not seem probable for most people looking at these answers.

The right thing to do in this case is to use other software which the authors themselves believe to be secure.

Here img2pdf fits the bill:

img2pdf --output out.pdf in.jpg
| improve this answer | |
  • 1
    How does disrupting the normal convert command make your computer more secure? – ar2015 Jun 11 at 1:33
  • This doesn't answer the question. The question is to convert to PDF. – Reinier Post Jul 26 at 12:52
  • @ReinierPost Well noticed, thanks! Answer corrected. – Sqerstet Jul 27 at 9:42
  • @Sqerstet: Thanks! I just tried it and it does exactly what I needed (it can create both an unresized version and a resized version for printing). – Reinier Post Aug 2 at 16:26
  • @ReinierPost So stop saying thanks and just give me a point :) – Sqerstet Aug 3 at 13:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.