Bug 12472

Summary: webkitgtk is vulnerable to Meltdown and Spectre defects
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Randy MacLeod <randy.macleod>
Component: graphicsAssignee: Alexander Kanavin <alex.kanavin>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: High CC: meta.mr.watcher, meta.watcher
Version: 2.5   
Target Milestone: 2.5 M2   
Hardware: x86   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: Don't know

Description Randy MacLeod 2018-01-10 17:31:55 UTC 
webkit[gtk], is vulnerable to some new CVEs as explained here:
   https://webkit.org/blog/8048/what-spectre-and-meltdown-mean-for-webkit/

   "WebKit is affected because in order to render modern web sites, any web JavaScript engine must allow untrusted JavaScript code to run on the user’s processor." 

and here:
   https://webkitgtk.org/security/WSA-2018-0001.html

There has been an update to webkitgtk:
   https://webkitgtk.org/2018/01/10/webkitgtk2.18.5-released.html
so the master branch should pick that up and see if the high res timer resolution degradations and other changes have any impact on our tests.

We should decide what to do for previous releases since webkit does not appear to provide a git repo and simply recommends upgrading to the latest release to fix CVEs.
Comment 1 Randy MacLeod 2018-01-10 17:34:40 UTC 
*** Bug 12471 has been marked as a duplicate of this bug. ***
Comment 2 Alexander Kanavin 2018-01-12 16:22:45 UTC 
Patches for master, rocko, pyro and morty all sent to oe-core list.