diff --git a/lftp.spec b/lftp.spec
index 364989e..f29d6fc 100644
--- a/lftp.spec
+++ b/lftp.spec
@@ -1,10 +1,11 @@
 Summary: A sophisticated file transfer program
 Name: lftp 
 Version: 2.4.9
-Release: 1
+Release: 2
 License: GPL
 Group: Applications/Internet
-Source: http://ftp.yars.free.net/pub/software/unix/net/ftp/client/lftp/lftp-%{version}.tar.bz2
+Source0: http://ftp.yars.free.net/pub/software/unix/net/ftp/client/lftp/lftp-%{version}.tar.bz2
+Patch0: lftp-2.6.9-ulf.patch
 URL: http://lftp.yar.ru/
 BuildRoot: %{_tmppath}/%{name}-%{version}-root
 BuildPrereq: ncurses-devel, openssl-devel, readline-devel
@@ -16,7 +17,8 @@ mirroring, and can transfer several files in parallel. It is designed with
 reliability in mind.
 
 %prep
-%setup -q  
+%setup -q
+%patch0 -p1 -b .ulf
 
 %build
 LDFLAGS=-L`pwd`/src/.libs ; export LDFLAGS
@@ -49,6 +51,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/lftp/%{version}/proto-http.so
 
 %changelog
+* Tue Dec  9 2003 Nalin Dahyabhai <nalin@redhat.com> 2.4.9-2
+- include patch based on patch from Ulf Härnhammar to fix unsafe use of
+  sscanf when reading http directory listings (CAN-2003-0963)
+
 * Fri Feb 22 2002 Nalin Dahyabhai <nalin@redhat.com> 2.4.9-1
 - update to 2.4.9-1