diff --git a/krb5.spec b/krb5.spec
index 3454eca..c9c4074 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -7,7 +7,7 @@
 Summary: The Kerberos network authentication system.
 Name: krb5
 Version: 1.3.5
-Release: 2
+Release: 3
 # Maybe we should explode from the now-available-to-everybody tarball instead?
 # http://web.mit.edu/kerberos/www/dist/krb5/1.3/krb5-1.3.5.tar
 Source0: krb5-%{version}.tar.gz
@@ -55,6 +55,8 @@ Patch25: krb5-1.3.1-null.patch
 Patch26: krb5-1.3.2-efence.patch
 Patch27: krb5-1.3.3-rcp-sendlarge.patch
 Patch28: krb5-1.3.5-gethostbyname_r.patch
+Patch29: krb5-1.3.5-kprop-mktemp.patch
+Patch30: krb5-1.3.4-send-pr-tempfile.patch
 License: MIT, freely distributable.
 URL: http://web.mit.edu/kerberos/www/
 Group: System Environment/Libraries
@@ -108,6 +110,8 @@ Summary: Kerberos 5 programs for use on workstations.
 Group: System Environment/Base
 Requires: %{name}-libs = %{version}-%{release}
 Prereq: grep, /sbin/install-info, /bin/sh, sh-utils
+# mktemp is used by krb5-send-pr
+Requires: mktemp
 
 %description workstation
 Kerberos is a network authentication system. The krb5-workstation
@@ -117,6 +121,13 @@ network uses Kerberos, this package should be installed on every
 workstation.
 
 %changelog
+* Mon Nov 22 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.5-3
+- fix predictable-tempfile-name bug in krb5-send-pr (CAN-2004-0971, #140036)
+
+* Tue Nov 16 2004 Nalin Dahyabhai <nalin@redhat.com>
+- silence compiler warning in kprop by using an in-memory ccache with a fixed
+  name instead of an on-disk ccache with a name generated by tmpnam()
+
 * Tue Nov 16 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.5-2
 - fix globbing patch port mode (#139075)
 
@@ -749,6 +760,8 @@ workstation.
 # %patch26 -p1 -b .efence
 %patch27 -p1 -b .rcp-sendlarge
 %patch28 -p1 -b .gethostbyname_r
+%patch29 -p1 -b .kprop-mktemp
+%patch30 -p1 -b .-send-pr-tempfile
 cp src/krb524/README README.krb524
 find . -type f -name "*.info-dir" -exec rm -fv "{}" ";"
 gzip doc/*.ps