diff --git a/texinfo-4.8-texindex.patch b/texinfo-4.8-texindex.patch
new file mode 100644
index 0000000..4c84eb7
--- /dev/null
+++ b/texinfo-4.8-texindex.patch
@@ -0,0 +1,576 @@
+--- texinfo-4.8/util/texindex.c.texindex	2004-04-11 19:56:47.000000000 +0200
++++ texinfo-4.8/util/texindex.c	2006-11-05 01:35:07.000000000 +0100
+@@ -37,16 +37,12 @@
+ #define memset(ptr, ignore, count) bzero (ptr, count)
+ #endif
+ 
+-char *mktemp (char *);
+-
+ #if !defined (SEEK_SET)
+ #  define SEEK_SET 0
+ #  define SEEK_CUR 1
+ #  define SEEK_END 2
+ #endif /* !SEEK_SET */
+ 
+-struct linebuffer;
+-
+ /* When sorting in core, this structure describes one line
+    and the position and length of its first keyfield.  */
+ struct lineinfo
+@@ -96,16 +92,6 @@
+ /* The allocated length of `linearray'. */
+ long nlines;
+ 
+-/* Directory to use for temporary files.  On Unix, it ends with a slash.  */
+-char *tempdir;
+-
+-/* Number of last temporary file.  */
+-int tempcount;
+-
+-/* Number of last temporary file already deleted.
+-   Temporary files are deleted by `flush_tempfiles' in order of creation.  */
+-int last_deleted_tempcount;
+-
+ /* During in-core sort, this points to the base of the data block
+    which contains all the lines of data.  */
+ char *text_base;
+@@ -117,15 +103,9 @@
+    determine whether we need initials in the sorted form.  */
+ char first_initial;
+ 
+-/* Additional command switches .*/
+-
+-/* Nonzero means do not delete tempfiles -- for debugging. */
+-int keep_tempfiles;
+-
+ /* Forward declarations of functions in this file. */
+ void decode_command (int argc, char **argv);
+ void sort_in_core (char *infile, int total, char *outfile);
+-void sort_offline (char *infile, off_t total, char *outfile);
+ char **parsefile (char *filename, char **nextline, char *data, long int size);
+ char *find_field (struct keyfield *keyfield, char *str, long int *lengthptr);
+ char *find_pos (char *str, int words, int chars, int ignore_blanks);
+@@ -137,26 +117,17 @@
+                    long int length1, long int pos1, char *start2,
+                    long int length2, long int pos2);
+ int compare_full (const void *, const void *);
+-long readline (struct linebuffer *linebuffer, FILE *stream);
+-int merge_files (char **infiles, int nfiles, char *outfile);
+-int merge_direct (char **infiles, int nfiles, char *outfile);
+ void pfatal_with_name (const char *name);
+ void fatal (const char *format, const char *arg);
+ void error (const char *format, const char *arg);
+ void *xmalloc (), *xrealloc ();
+ char *concat (char *s1, char *s2);
+-void flush_tempfiles (int to_count);
+ 
+-#define MAX_IN_CORE_SORT 500000
+-
+ int
+ main (int argc, char **argv)
+ {
+   int i;
+ 
+-  tempcount = 0;
+-  last_deleted_tempcount = 0;
+-
+ #ifdef HAVE_SETLOCALE
+   /* Set locale via LC_ALL.  */
+   setlocale (LC_ALL, "");
+@@ -225,14 +196,15 @@
+       need_initials = 0;
+       first_initial = '\0';
+ 
+-      if (ptr < MAX_IN_CORE_SORT)
+-        /* Sort a small amount of data. */
+-        sort_in_core (infiles[i], (int)ptr, outfile);
+-      else
+-        sort_offline (infiles[i], ptr, outfile);
++      if (ptr != (int)ptr)
++	{
++	  fprintf (stderr, "%s: %s: file too large\n", program_name,
++		   infiles[i]);
++	  xexit (1);
++	}
++      sort_in_core (infiles[i], (int)ptr, outfile);
+     }
+ 
+-  flush_tempfiles (tempcount);
+   xexit (0);
+   return 0; /* Avoid bogus warnings.  */
+ }
+@@ -250,10 +222,6 @@
+ TEXINDEX_OPTION texindex_options[] = {
+   { "--help", "-h", (int *)NULL, 0, (char *)NULL,
+       N_("display this help and exit") },
+-  { "--keep", "-k", &keep_tempfiles, 1, (char *)NULL,
+-      N_("keep temporary files around after processing") },
+-  { "--no-keep", 0, &keep_tempfiles, 0, (char *)NULL,
+-      N_("do not keep temporary files around after processing (default)") },
+   { "--output", "-o", (int *)NULL, 0, "FILE",
+       N_("send output to FILE") },
+   { "--version", (char *)NULL, (int *)NULL, 0, (char *)NULL,
+@@ -308,20 +276,6 @@
+   char **ip;
+   char **op;
+ 
+-  /* Store default values into parameter variables. */
+-
+-  tempdir = getenv ("TMPDIR");
+-  if (tempdir == NULL)
+-    tempdir = getenv ("TEMP");
+-  if (tempdir == NULL)
+-    tempdir = getenv ("TMP");
+-  if (tempdir == NULL)
+-    tempdir = DEFAULT_TMPDIR;
+-  else
+-    tempdir = concat (tempdir, "/");
+-
+-  keep_tempfiles = 0;
+-
+   /* Allocate ARGC input files, which must be enough.  */
+ 
+   infiles = (char **) xmalloc (argc * sizeof (char *));
+@@ -348,7 +302,7 @@
+           else if ((strcmp (arg, "--keep") == 0) ||
+                    (strcmp (arg, "-k") == 0))
+             {
+-              keep_tempfiles = 1;
++	      /* Ignore, for backward compatibility */
+             }
+           else if ((strcmp (arg, "--help") == 0) ||
+                    (strcmp (arg, "-h") == 0))
+@@ -384,41 +338,6 @@
+     usage (1);
+ }
+ 
+-/* Return a name for temporary file COUNT. */
+-
+-static char *
+-maketempname (int count)
+-{
+-  static char *tempbase = NULL;
+-  char tempsuffix[10];
+-
+-  if (!tempbase)
+-    {
+-      int fd;
+-      tempbase = concat (tempdir, "txidxXXXXXX");
+-
+-      fd = mkstemp (tempbase);
+-      if (fd == -1)
+-        pfatal_with_name (tempbase);
+-    }
+-
+-  sprintf (tempsuffix, ".%d", count);
+-  return concat (tempbase, tempsuffix);
+-}
+-
+-
+-/* Delete all temporary files up to TO_COUNT. */
+-
+-void
+-flush_tempfiles (int to_count)
+-{
+-  if (keep_tempfiles)
+-    return;
+-  while (last_deleted_tempcount < to_count)
+-    unlink (maketempname (++last_deleted_tempcount));
+-}
+-
+-
+ /* Compare LINE1 and LINE2 according to the specified set of keyfields. */
+ 
+ int
+@@ -801,150 +720,6 @@
+     }
+ }
+ 
+-/* A `struct linebuffer' is a structure which holds a line of text.
+-   `readline' reads a line from a stream into a linebuffer
+-   and works regardless of the length of the line.  */
+-
+-struct linebuffer
+-{
+-  long size;
+-  char *buffer;
+-};
+-
+-/* Initialize LINEBUFFER for use. */
+-
+-void
+-initbuffer (struct linebuffer *linebuffer)
+-{
+-  linebuffer->size = 200;
+-  linebuffer->buffer = (char *) xmalloc (200);
+-}
+-
+-/* Read a line of text from STREAM into LINEBUFFER.
+-   Return the length of the line.  */
+-
+-long
+-readline (struct linebuffer *linebuffer, FILE *stream)
+-{
+-  char *buffer = linebuffer->buffer;
+-  char *p = linebuffer->buffer;
+-  char *end = p + linebuffer->size;
+-
+-  while (1)
+-    {
+-      int c = getc (stream);
+-      if (p == end)
+-        {
+-          buffer = (char *) xrealloc (buffer, linebuffer->size *= 2);
+-          p += buffer - linebuffer->buffer;
+-          end += buffer - linebuffer->buffer;
+-          linebuffer->buffer = buffer;
+-        }
+-      if (c < 0 || c == '\n')
+-        {
+-          *p = 0;
+-          break;
+-        }
+-      *p++ = c;
+-    }
+-
+-  return p - buffer;
+-}
+-
+-/* Sort an input file too big to sort in core.  */
+-
+-void
+-sort_offline (char *infile, off_t total, char *outfile)
+-{
+-  /* More than enough. */
+-  int ntemps = 2 * (total + MAX_IN_CORE_SORT - 1) / MAX_IN_CORE_SORT;
+-  char **tempfiles = (char **) xmalloc (ntemps * sizeof (char *));
+-  FILE *istream = fopen (infile, "r");
+-  int i;
+-  struct linebuffer lb;
+-  long linelength;
+-  int failure = 0;
+-
+-  initbuffer (&lb);
+-
+-  /* Read in one line of input data.  */
+-
+-  linelength = readline (&lb, istream);
+-
+-  if (lb.buffer[0] != '\\' && lb.buffer[0] != '@')
+-    {
+-      error (_("%s: not a texinfo index file"), infile);
+-      return;
+-    }
+-
+-  /* Split up the input into `ntemps' temporary files, or maybe fewer,
+-     and put the new files' names into `tempfiles' */
+-
+-  for (i = 0; i < ntemps; i++)
+-    {
+-      char *outname = maketempname (++tempcount);
+-      FILE *ostream = fopen (outname, "w");
+-      long tempsize = 0;
+-
+-      if (!ostream)
+-        pfatal_with_name (outname);
+-      tempfiles[i] = outname;
+-
+-      /* Copy lines into this temp file as long as it does not make file
+-         "too big" or until there are no more lines.  */
+-
+-      while (tempsize + linelength + 1 <= MAX_IN_CORE_SORT)
+-        {
+-          tempsize += linelength + 1;
+-          fputs (lb.buffer, ostream);
+-          putc ('\n', ostream);
+-
+-          /* Read another line of input data.  */
+-
+-          linelength = readline (&lb, istream);
+-          if (!linelength && feof (istream))
+-            break;
+-
+-          if (lb.buffer[0] != '\\' && lb.buffer[0] != '@')
+-            {
+-              error (_("%s: not a texinfo index file"), infile);
+-              failure = 1;
+-              goto fail;
+-            }
+-        }
+-      fclose (ostream);
+-      if (feof (istream))
+-        break;
+-    }
+-
+-  free (lb.buffer);
+-
+-fail:
+-  /* Record number of temp files we actually needed.  */
+-
+-  ntemps = i;
+-
+-  /* Sort each tempfile into another tempfile.
+-    Delete the first set of tempfiles and put the names of the second
+-    into `tempfiles'. */
+-
+-  for (i = 0; i < ntemps; i++)
+-    {
+-      char *newtemp = maketempname (++tempcount);
+-      sort_in_core (tempfiles[i], MAX_IN_CORE_SORT, newtemp);
+-      if (!keep_tempfiles)
+-        unlink (tempfiles[i]);
+-      tempfiles[i] = newtemp;
+-    }
+-
+-  if (failure)
+-    return;
+-
+-  /* Merge the tempfiles together and indexify. */
+-
+-  merge_files (tempfiles, ntemps, outfile);
+-}
+-
+ /* Sort INFILE, whose size is TOTAL,
+    assuming that is small enough to be done in-core,
+    then indexify it and send the output to OUTFILE (or to stdout).  */
+@@ -1348,8 +1123,7 @@
+ 
+   for (next_line = linearray; next_line != stop_line; next_line++)
+     {
+-      /* If -u was specified, output the line only if distinct from
+-         previous one.  */
++      /* Output the line only if distinct from previous one.  */
+       if (next_line == linearray
+       /* Compare previous line with this one, using only the
+          explicitly specd keyfields. */
+@@ -1369,215 +1143,6 @@
+   finish_index (ostream);
+ }
+ 
+-/* Assume (and optionally verify) that each input file is sorted;
+-   merge them and output the result.
+-   Returns nonzero if any input file fails to be sorted.
+-
+-   This is the high-level interface that can handle an unlimited
+-   number of files.  */
+-
+-#define MAX_DIRECT_MERGE 10
+-
+-int
+-merge_files (char **infiles, int nfiles, char *outfile)
+-{
+-  char **tempfiles;
+-  int ntemps;
+-  int i;
+-  int value = 0;
+-  int start_tempcount = tempcount;
+-
+-  if (nfiles <= MAX_DIRECT_MERGE)
+-    return merge_direct (infiles, nfiles, outfile);
+-
+-  /* Merge groups of MAX_DIRECT_MERGE input files at a time,
+-     making a temporary file to hold each group's result.  */
+-
+-  ntemps = (nfiles + MAX_DIRECT_MERGE - 1) / MAX_DIRECT_MERGE;
+-  tempfiles = (char **) xmalloc (ntemps * sizeof (char *));
+-  for (i = 0; i < ntemps; i++)
+-    {
+-      int nf = MAX_DIRECT_MERGE;
+-      if (i + 1 == ntemps)
+-        nf = nfiles - i * MAX_DIRECT_MERGE;
+-      tempfiles[i] = maketempname (++tempcount);
+-      value |= merge_direct (&infiles[i * MAX_DIRECT_MERGE], nf, tempfiles[i]);
+-    }
+-
+-  /* All temporary files that existed before are no longer needed
+-     since their contents have been merged into our new tempfiles.
+-     So delete them.  */
+-  flush_tempfiles (start_tempcount);
+-
+-  /* Now merge the temporary files we created.  */
+-
+-  merge_files (tempfiles, ntemps, outfile);
+-
+-  free (tempfiles);
+-
+-  return value;
+-}
+-
+-/* Assume (and optionally verify) that each input file is sorted;
+-   merge them and output the result.
+-   Returns nonzero if any input file fails to be sorted.
+-
+-   This version of merging will not work if the number of
+-   input files gets too high.  Higher level functions
+-   use it only with a bounded number of input files.  */
+-
+-int
+-merge_direct (char **infiles, int nfiles, char *outfile)
+-{
+-  struct linebuffer *lb1, *lb2;
+-  struct linebuffer **thisline, **prevline;
+-  FILE **streams;
+-  int i;
+-  int nleft;
+-  int lossage = 0;
+-  int *file_lossage;
+-  struct linebuffer *prev_out = 0;
+-  FILE *ostream = stdout;
+-
+-  if (outfile)
+-    {
+-      ostream = fopen (outfile, "w");
+-    }
+-  if (!ostream)
+-    pfatal_with_name (outfile);
+-
+-  init_index ();
+-
+-  if (nfiles == 0)
+-    {
+-      if (outfile)
+-        fclose (ostream);
+-      return 0;
+-    }
+-
+-  /* For each file, make two line buffers.  Also, for each file, there
+-     is an element of `thisline' which points at any time to one of the
+-     file's two buffers, and an element of `prevline' which points to
+-     the other buffer.  `thisline' is supposed to point to the next
+-     available line from the file, while `prevline' holds the last file
+-     line used, which is remembered so that we can verify that the file
+-     is properly sorted. */
+-
+-  /* lb1 and lb2 contain one buffer each per file. */
+-  lb1 = (struct linebuffer *) xmalloc (nfiles * sizeof (struct linebuffer));
+-  lb2 = (struct linebuffer *) xmalloc (nfiles * sizeof (struct linebuffer));
+-
+-  /* thisline[i] points to the linebuffer holding the next available
+-     line in file i, or is zero if there are no lines left in that file.  */
+-  thisline = (struct linebuffer **)
+-    xmalloc (nfiles * sizeof (struct linebuffer *));
+-  /* prevline[i] points to the linebuffer holding the last used line
+-     from file i.  This is just for verifying that file i is properly
+-     sorted.  */
+-  prevline = (struct linebuffer **)
+-    xmalloc (nfiles * sizeof (struct linebuffer *));
+-  /* streams[i] holds the input stream for file i.  */
+-  streams = (FILE **) xmalloc (nfiles * sizeof (FILE *));
+-  /* file_lossage[i] is nonzero if we already know file i is not
+-     properly sorted.  */
+-  file_lossage = (int *) xmalloc (nfiles * sizeof (int));
+-
+-  /* Allocate and initialize all that storage. */
+-
+-  for (i = 0; i < nfiles; i++)
+-    {
+-      initbuffer (&lb1[i]);
+-      initbuffer (&lb2[i]);
+-      thisline[i] = &lb1[i];
+-      prevline[i] = &lb2[i];
+-      file_lossage[i] = 0;
+-      streams[i] = fopen (infiles[i], "r");
+-      if (!streams[i])
+-        pfatal_with_name (infiles[i]);
+-
+-      readline (thisline[i], streams[i]);
+-    }
+-
+-  /* Keep count of number of files not at eof. */
+-  nleft = nfiles;
+-
+-  while (nleft)
+-    {
+-      struct linebuffer *best = 0;
+-      struct linebuffer *exch;
+-      int bestfile = -1;
+-      int i;
+-
+-      /* Look at the next avail line of each file; choose the least one.  */
+-
+-      for (i = 0; i < nfiles; i++)
+-        {
+-          if (thisline[i] &&
+-              (!best ||
+-               0 < compare_general (best->buffer, thisline[i]->buffer,
+-                                 (long) bestfile, (long) i, num_keyfields)))
+-            {
+-              best = thisline[i];
+-              bestfile = i;
+-            }
+-        }
+-
+-      /* Output that line, unless it matches the previous one and we
+-         don't want duplicates. */
+-
+-      if (!(prev_out &&
+-            !compare_general (prev_out->buffer,
+-                              best->buffer, 0L, 1L, num_keyfields - 1)))
+-        indexify (best->buffer, ostream);
+-      prev_out = best;
+-
+-      /* Now make the line the previous of its file, and fetch a new
+-         line from that file.  */
+-
+-      exch = prevline[bestfile];
+-      prevline[bestfile] = thisline[bestfile];
+-      thisline[bestfile] = exch;
+-
+-      while (1)
+-        {
+-          /* If the file has no more, mark it empty. */
+-
+-          if (feof (streams[bestfile]))
+-            {
+-              thisline[bestfile] = 0;
+-              /* Update the number of files still not empty. */
+-              nleft--;
+-              break;
+-            }
+-          readline (thisline[bestfile], streams[bestfile]);
+-          if (thisline[bestfile]->buffer[0] || !feof (streams[bestfile]))
+-            break;
+-        }
+-    }
+-
+-  finish_index (ostream);
+-
+-  /* Free all storage and close all input streams. */
+-
+-  for (i = 0; i < nfiles; i++)
+-    {
+-      fclose (streams[i]);
+-      free (lb1[i].buffer);
+-      free (lb2[i].buffer);
+-    }
+-  free (file_lossage);
+-  free (lb1);
+-  free (lb2);
+-  free (thisline);
+-  free (prevline);
+-  free (streams);
+-
+-  if (outfile)
+-    fclose (ostream);
+-
+-  return lossage;
+-}
+-
+ /* Print error message and exit.  */
+ 
+ void
+--- texinfo-4.8/doc/texindex.1.texindex	2004-12-31 19:02:16.000000000 +0100
++++ texinfo-4.8/doc/texindex.1	2006-11-05 01:31:56.000000000 +0100
+@@ -13,12 +13,6 @@
+ \fB\-h\fR, \fB\-\-help\fR
+ display this help and exit
+ .TP
+-\fB\-k\fR, \fB\-\-keep\fR
+-keep temporary files around after processing
+-.TP
+-\fB\-\-no\-keep\fR
+-do not keep temporary files around after processing (default)
+-.TP
+ \fB\-o\fR, \fB\-\-output\fR FILE
+ send output to FILE
+ .TP
diff --git a/texinfo.spec b/texinfo.spec
index d8c6c1c..f04631b 100644
--- a/texinfo.spec
+++ b/texinfo.spec
@@ -1,15 +1,15 @@
 Summary: Tools needed to create Texinfo format documentation files.
 Name: texinfo
 Version: 4.8
-Release: 13
+Release: 14%{?dist}
 License: GPL
 Group: Applications/Publishing
 Url: http://www.gnu.org/software/texinfo/
 Source0: ftp://ftp.gnu.org/gnu/texinfo/texinfo-%{version}.tar.bz2
 Source1: info-dir
 Source2: texi2pdf.man
-Patch1: texinfo-4.8-zlib.patch
-Patch2: texinfo-CAN-2005-3011.patch
+Patch0: texinfo-4.8-zlib.patch
+Patch1: texinfo-4.8-texindex.patch
 Prereq: /sbin/install-info
 Buildroot: %{_tmppath}/%{name}-%{version}-root
 BuildRequires: zlib-devel, ncurses-devel
@@ -58,8 +58,8 @@ for printing using TeX.
 
 %prep
 %setup -q
-%patch1 -p1 -b .zlib
-%patch2 -p1 -b .CAN-2005-3011
+%patch0 -p1 -b .zlib
+%patch1 -p1 -b .texindex
 
 %build
 
@@ -137,6 +137,9 @@ fi
 %{_mandir}/man1/texi2pdf.1*
 
 %changelog
+* Sun Nov  5 2006 Miloslav Trmac <mitr@redhat.com> - 4.8-14
+- Remove off-line sorting from texindex (fixes CVE 2006-4810)
+
 * Mon Oct  9 2006 Miloslav Trmac <mitr@redhat.com> - 4.8-13
 - Don't use mode 0666 for the texindex temporary files