diff --git a/pkgs/applications/graphics/graphicsmagick/default.nix b/pkgs/applications/graphics/graphicsmagick/default.nix
index 95cfcaef01a2..63b88ee4fb94 100644
--- a/pkgs/applications/graphics/graphicsmagick/default.nix
+++ b/pkgs/applications/graphics/graphicsmagick/default.nix
@@ -1,22 +1,28 @@
 {stdenv, fetchurl, bzip2, freetype, graphviz, ghostscript
 , libjpeg, libpng, libtiff, libxml2, zlib, libtool, xz
-, libX11, quantumdepth ? 8}:
+, libX11, libwebp, quantumdepth ? 8}:
 
-let version = "1.3.21"; in
+let version = "1.3.23"; in
 
 stdenv.mkDerivation {
   name = "graphicsmagick-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/graphicsmagick/GraphicsMagick-${version}.tar.xz";
-    sha256 = "07rwpxy62r9m4r2cg6yll2nr698mxyvbji8vgsivcxhpk56k0ich";
+    sha256 = "03g6l2h8cmf231y1vma0z7x85070jm1ysgs9ppqcd3jj56jka9gx";
   };
 
-  configureFlags = "--enable-shared --with-quantum-depth=" + toString quantumdepth;
+  patches = [ ./disable-popen.patch ];
+
+  configureFlags = [
+    "--enable-shared"
+    "--with-quantum-depth=${toString quantumdepth}"
+    "--with-gslib=yes"
+  ];
 
   buildInputs =
     [ bzip2 freetype ghostscript graphviz libjpeg libpng libtiff libX11 libxml2
-      zlib libtool
+      zlib libtool libwebp
     ];
 
   nativeBuildInputs = [ xz ];
diff --git a/pkgs/applications/graphics/graphicsmagick/disable-popen.patch b/pkgs/applications/graphics/graphicsmagick/disable-popen.patch
new file mode 100644
index 000000000000..2cdb1f7e90f7
--- /dev/null
+++ b/pkgs/applications/graphics/graphicsmagick/disable-popen.patch
@@ -0,0 +1,12 @@
+http://permalink.gmane.org/gmane.comp.security.oss.general/19669
+
+--- a/magick/blob.c Sat Nov 07 14:49:16 2015 -0600
++++ b/magick/blob.c Sun May 29 14:12:57 2016 -0500
+@@ -68,6 +68,7 @@
+ */
+ #define DefaultBlobQuantum  65541
+ 
++#undef HAVE_POPEN
+ 
+ /*
+   Enum declarations.