diff --git a/.gitignore b/.gitignore
index 9e98762..c2cafd9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -17,3 +17,4 @@ unbound-1.4.5.tar.gz
 /unbound-1.4.11.tar.gz
 /unbound-1.4.12.tar.gz
 /unbound-1.4.13.tar.gz
+/unbound-1.4.14.tar.gz
diff --git a/sources b/sources
index 0c3dd89..fc8e3ae 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
 7e3b27dee2b97640dd2e1783253317ab  unbound-1.4.13.tar.gz
+cd69fdaaa6af01ea0b6fbc59802f74ba  unbound-1.4.14.tar.gz
diff --git a/unbound.spec b/unbound.spec
index b24d0c0..a4003e6 100644
--- a/unbound.spec
+++ b/unbound.spec
@@ -8,7 +8,7 @@
 
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
-Version: 1.4.13
+Version: 1.4.14
 Release: 1%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/
@@ -222,6 +222,11 @@ fi
 /bin/systemctl try-restart unbound-keygen.service >/dev/null 2>&1 || :
 
 %changelog
+* Mon Dec 19 2011 Paul Wouters <paul@xelerance.com> - 1.4.13-2
+- Upgraded to 1.4.14 for CVE-2011-4528 / VU#209659
+- SSL-wrapped query support for dnssec-trigger
+- EDNS handling changes
+
 * Thu Sep 15 2011 Paul Wouters <paul@xelerance.com> - 1.4.13-1
 - Upgraded to 1.4.13
 - Removed merged in pythonmod patch