diff --git a/.cvsignore b/.cvsignore
index 726e05e..4ebdf40 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,2 +1,2 @@
 config-4.tar.bz2
-bind-9.6.1-P1.tar.gz
+bind-9.6.1-P2.tar.gz
diff --git a/bind.spec b/bind.spec
index 882f5d2..39860ac 100644
--- a/bind.spec
+++ b/bind.spec
@@ -2,7 +2,7 @@
 # Red Hat BIND package .spec file
 #
 
-%define PATCHVER P1
+%define PATCHVER P2
 #%define PREVER rc1
 #%define VERSION %{version}
 #%define VERSION %{version}-%{PATCHVER}
@@ -20,7 +20,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  ISC
 Version:  9.6.1
-Release:  6.%{PATCHVER}%{?dist}
+Release:  7.%{PATCHVER}%{?dist}
 Epoch:    32
 Url:      http://www.isc.org/products/BIND/
 Buildroot:%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -588,6 +588,9 @@ rm -rf ${RPM_BUILD_ROOT}
 %ghost %{chroot_prefix}/etc/localtime
 
 %changelog
+* Wed Nov 25 2009 Adam Tkac <atkac redhat com> 32:9.6.1-7.P2
+- update to 9.6.1-P2 (CVE-2009-4022)
+
 * Mon Sep 21 2009 Adam Tkac <atkac redhat com> 32:9.6.1-6.P1
 - determine file size via `stat` instead of `ls` (#523682)
 
diff --git a/sources b/sources
index 559b924..9c812db 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 de68e10e91e05ab100be879b5bcaa6cb  config-4.tar.bz2
-e6ce3b355c4e6bf5d66ef100f555da3f  bind-9.6.1-P1.tar.gz
+435bc2e26e470d46ddf2acb24abb6ea6  bind-9.6.1-P2.tar.gz