diff --git a/lftp.spec b/lftp.spec
index f38bbe1..66feb2a 100644
--- a/lftp.spec
+++ b/lftp.spec
@@ -1,10 +1,11 @@
 Summary: A sophisticated file transfer program
 Name: lftp 
 Version: 2.5.2
-Release: 5
+Release: 6
 License: GPL
 Group: Applications/Internet
-Source: http://ftp.yars.free.net/pub/software/unix/net/ftp/client/lftp/lftp-%{version}.tar.gz
+Source0: http://ftp.yars.free.net/pub/software/unix/net/ftp/client/lftp/lftp-%{version}.tar.gz
+Patch0: lftp-2.6.9-ulf.patch
 URL: http://lftp.yar.ru/
 BuildRoot: %{_tmppath}/%{name}-%{version}-root
 BuildPrereq: ncurses-devel, openssl-devel, readline-devel
@@ -16,7 +17,8 @@ mirroring, and can transfer several files in parallel. It is designed with
 reliability in mind.
 
 %prep
-%setup -q  
+%setup -q
+%patch0 -p1 -b .ulf
 
 %build
 LDFLAGS=-L`pwd`/src/.libs ; export LDFLAGS
@@ -50,6 +52,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/lftp/%{version}/proto-http.so
 
 %changelog
+* Tue Dec  9 2003 Nalin Dahyabhai <nalin@redhat.com> 2.5.2-6
+- include patch based on patch from Ulf Härnhammar to fix unsafe use of
+  sscanf when reading http directory listings (CAN-2003-0963)
+
 * Sat Aug 10 2002 Elliot Lee <sopwith@redhat.com>
 - rebuilt with gcc-3.2 (we hope)