app-emacs/mew-6.6 is now available. For a security reason, please bump to it. mew-6.5, the latest in the portage tree, does not support net-misc/stunnel >=5, but stunnel < 5.02 are vulnerable, and were dropped from the portage tree. Just copying mew-6.5.ebuild to 6.6 should work, judging from the release note: http://mew.org/en/relnote/release.html At least it's ok for me so far. I don't know what to do with mew-6.5.ebuild. If you don't enable IUSE=+ssl, then mew-6.5 is still fine. Maybe keep it, adding ! stunnel >= 5? # No one has requested this version bump after the first stabilization of stunnel-5 on 10 June. Maybe I'm the last one who uses mew on Gentoo? :P
Bumped to 6.6. Thank you for reporting. (In reply to teika from comment #0) > I don't know what to do with mew-6.5.ebuild. If you don't enable IUSE=+ssl, > then mew-6.5 is still fine. Maybe keep it, adding ! stunnel >= 5? Not much that we can do there. Adding the blocker would encourage users keeping old and vulnerable versions of stunnel which I think is not a good idea. Also note that mew-6.5 itself is not vulnerable. We could go for speedy stabilisation of mew-6.6. Please test this version and report back here.
I, the reporter of this bug, "tested" it. (I know I'm not an arch tester.) Or more correctly, for my ordinary uses the Müller's new ebuild hasn't shown any problem, and that's all I can say. I use USE="linguas_ja ssl", on emacs-24.3-r2 on amd64. Thank you very much, Ulrich, for your long effort in Emacs in Gentoo, and to all Gentoo developers.
Testing by an actual user of a package is usually more complete than what an arch tester (who is often not very familiar with a package) can do. Thank you. I've filed bug 522312 for rapid stabilisation of mew-6.6.
