diff --git a/postfix-2.3.3-biff-cloexec.patch b/postfix-2.3.3-biff-cloexec.patch
new file mode 100644
index 0000000..86a17e8
--- /dev/null
+++ b/postfix-2.3.3-biff-cloexec.patch
@@ -0,0 +1,27 @@
+diff -up postfix-2.3.3/src/local/biff_notify.c.orig2 postfix-2.3.3/src/local/biff_notify.c
+--- postfix-2.3.3/src/local/biff_notify.c.orig2	2005-07-13 22:46:18.000000000 +0200
++++ postfix-2.3.3/src/local/biff_notify.c	2012-07-02 18:17:28.694042972 +0200
+@@ -46,6 +46,7 @@
+ 
+ /* Application-specific. */
+ 
++#include "iostuff.h"
+ #include <biff_notify.h>
+ 
+ /* biff_notify - notify recipient via the biff "protocol" */
+@@ -81,9 +82,12 @@ void    biff_notify(const char *text, ss
+     /*
+      * Open a socket, or re-use an existing one.
+      */
+-    if (sock < 0 && (sock = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
+-	msg_warn("socket: %m");
+-	return;
++    if (sock < 0) {
++	if ((sock = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
++	    msg_warn("socket: %m");
++	    return;
++	}
++	close_on_exec(sock, CLOSE_ON_EXEC);
+     }
+ 
+     /*
diff --git a/postfix.spec b/postfix.spec
index bab81fa..b2c07fd 100644
--- a/postfix.spec
+++ b/postfix.spec
@@ -38,7 +38,7 @@
 Name: postfix
 Summary: Postfix Mail Transport Agent
 Version: 2.9.3
-Release: 1%{?dist}
+Release: 2%{?dist}
 Epoch: 2
 Group: System Environment/Daemons
 URL: http://www.postfix.org
@@ -79,6 +79,8 @@ Patch2: postfix-2.6.1-files.patch
 Patch3: postfix-alternatives.patch
 Patch8: postfix-large-fs.patch
 Patch9: pflogsumm-1.1.3-datecalc.patch
+# Fix for FD leak in biff (accepted upstream)
+Patch10: postfix-2.3.3-biff-cloexec.patch
 
 # Optional patches - set the appropriate environment variables to include
 #		     them when building the package/spec file
@@ -147,6 +149,8 @@ pushd pflogsumm-%{pflogsumm_ver}
 popd
 %endif
 
+%patch10 -p1 -b .biff-cloexec
+
 for f in README_FILES/TLS_{LEGACY_,}README TLS_ACKNOWLEDGEMENTS; do
 	iconv -f iso8859-1 -t utf8 -o ${f}{_,} &&
 		touch -r ${f}{,_} && mv -f ${f}{_,}
@@ -525,6 +529,9 @@ rm -rf $RPM_BUILD_ROOT
 %endif
 
 %changelog
+* Tue Jul 03 2012 Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.9.3-2
+- Fixed FD leak in biff
+
 * Tue Jun  5 2012 Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.9.3-1
 - New version
   Resolves: rhbz#828242