diff --git a/PKGBUILD b/PKGBUILD
index 6577ea9..af54ffd 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -4,18 +4,20 @@
 
 pkgname=elfutils
 pkgver=0.161
-pkgrel=2
+pkgrel=3
 pkgdesc="Libraries and utilities to handle ELF object files and DWARF debugging information"
 arch=('i686' 'x86_64')
 url="https://fedorahosted.org/elfutils/"
 license=('LGPL3' 'GPL' 'GPL3')
 depends=('gcc-libs' 'zlib' 'bzip2' 'xz')
 source=(https://fedorahosted.org/releases/e/l/elfutils/${pkgver}/elfutils-${pkgver}.tar.bz2{,.sig}
-        0001-tests-Make-deleted-and-vdsosyms-testcases-work-with-.patch)
+        0001-tests-Make-deleted-and-vdsosyms-testcases-work-with-.patch
+        CVE-2014-9447.patch::https://git.fedorahosted.org/cgit/elfutils.git/patch/?id=147018e729e7c22eeabf15b82d26e4bf68a0d18e)
 options=('staticlibs')
 sha1sums=('85d48e18359c51e843c49b1894b2f54b85e88ae2'
           'SKIP'
-          '86947fb8d0f51a65e19142350925f428ad0c7cb1')
+          '86947fb8d0f51a65e19142350925f428ad0c7cb1'
+          'd3e0e8275695fcc6347b8730bd1eb141a022f756')
 validpgpkeys=('47CC0331081B8BC6D0FD4DA08370665B57816A6A')  # Mark J. Wielaard <mark@klomp.org>
 
 prepare() {
@@ -23,6 +25,9 @@ prepare() {
 
   # https://lists.fedorahosted.org/pipermail/elfutils-devel/2015-January/004541.html
   patch -p1 < "$srcdir"/0001-tests-Make-deleted-and-vdsosyms-testcases-work-with-.patch
+
+  # fix CVE-2014-9447
+  patch -Np1 < "${srcdir}/CVE-2014-9447.patch"
 }
 
 build() {