diff --git a/.gitignore b/.gitignore
index 4baea8b..7f0fd91 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 aubio-0.3.2.tar.gz
 /aubio-0.4.2.tar.bz2
 /aubio-0.4.6.tar.bz2
+/aubio-0.4.9.tar.bz2
diff --git a/aubio-unversioned-python.patch b/aubio-unversioned-python.patch
new file mode 100644
index 0000000..6fbc896
--- /dev/null
+++ b/aubio-unversioned-python.patch
@@ -0,0 +1,23 @@
+diff --git a/tests/create_tests_source.py b/tests/create_tests_source.py
+index 1feb1443..2c5560f4 100755
+--- a/tests/create_tests_source.py
++++ b/tests/create_tests_source.py
+@@ -1,4 +1,4 @@
+-#! /usr/bin/env python
++#!/usr/bin/python2
+ 
+ """ Create a simple stereo file containing a sine tone at 441 Hz, using only
+ python's built-in modules. """
+diff --git a/tests/wscript_build b/tests/wscript_build
+index c99a051e..d3fd0633 100644
+--- a/tests/wscript_build
++++ b/tests/wscript_build
+@@ -13,7 +13,7 @@ test_sound_abspath = bld.path.get_bld().make_node(test_sound_target)
+ test_sound_abspath = str(test_sound_abspath).replace('\\', '\\\\')
+ 
+ b = bld(name='create_tests_source',
+-    rule='python ${SRC} ${TGT}',
++    rule='python2 ${SRC} ${TGT}',
+     source='create_tests_source.py',
+     target=test_sound_target)
+ # use post() to create the task, keep a reference to it
diff --git a/aubio.spec b/aubio.spec
index a6f5e3e..0edc8db 100644
--- a/aubio.spec
+++ b/aubio.spec
@@ -7,13 +7,14 @@
 %endif
 
 Name:           aubio
-Version:        0.4.6
-Release:        4%{?dist}
-Summary:        An audio labelling library
+Version:        0.4.9
+Release:        1%{?dist}
+Summary:        An audio labeling library
 
 License:        GPLv3+
 URL:            http://aubio.org/
 Source0:        http://aubio.org/pub/aubio-%{version}.tar.bz2
+Patch0:         %{name}-unversioned-python.patch
 
 BuildRequires:  doxygen
 BuildRequires:  fftw-devel
@@ -30,14 +31,14 @@ BuildRequires:  txt2man
 BuildRequires:  python2
 
 %description
-aubio is a library for audio labelling. Its features include
+aubio is a library for audio labeling. Its features include
 segmenting a sound file before each of its attacks, performing pitch
 detection, tapping the beat and producing midi streams from live
 audio. The name aubio comes from 'audio' with a typo: several
 transcription errors are likely to be found in the results too.
 
-The aim of this project is to provide these automatic labelling
-features to other audio softwares. Functions can be used offline in
+The aim of this project is to provide these automatic labeling
+features to other audio software. Functions can be used offline in
 sound editors and software samplers, or online in audio effects and
 virtual instruments.
 
@@ -50,7 +51,7 @@ Requires:       pkgconfig
 The %{name}-devel package contains libraries and header files for
 developing applications that use %{name}.
 
-%package	    python3
+%package        python3
 Summary:        Python 3 language bindings for %{name}
 Requires:       %{name} = %{version}-%{release}
 Requires:       python3
@@ -63,6 +64,8 @@ The %{name}-python3 package contains the Python 3 language bindings for
 %autosetup -p1
 
 %build
+%set_build_flags
+
 python2 ./waf configure \
     --prefix="%_prefix" \
     --bindir="%_bindir" \
@@ -88,11 +91,12 @@ rm -rf libaubio-doc
 cp -r %{buildroot}%{_docdir}/libaubio-doc libaubio-doc
 rm -rf %{buildroot}%{_docdir}/libaubio-doc
 
-
 %py3_install
 
 %ldconfig_scriptlets
 
+# Remove shebang from python files
+sed -i -e '/^#![[:blank:]]*\//, 1d' %{buildroot}%{python3_sitearch}/%{name}/*.py
 
 %files
 %license COPYING
@@ -102,7 +106,7 @@ rm -rf %{buildroot}%{_docdir}/libaubio-doc
 %{_mandir}/man1/*
 
 %files devel
-%doc libaubio-doc/html
+%doc libaubio-doc/api
 %{_libdir}/pkgconfig/*.pc
 %{_libdir}/*.so
 %{_includedir}/aubio
@@ -112,6 +116,13 @@ rm -rf %{buildroot}%{_docdir}/libaubio-doc
 %{python3_sitearch}/%{name}*.egg-info
 
 %changelog
+* Thu Aug 01 2019 Guido Aulisi <guido.aulisi@gmail.com> - 0.4.9-1
+- Update to 0.4.9
+- Some spec cleanup
+- CVE-2018-19800 prevent a possible buffer overflow in new_aubio_tempo
+- CVE-2018-19801 prevent a null-pointer dereference in new_aubio_filterbank
+- CVE-2018-19802 prevent a null-pointer dereference in new_aubio_onset
+
 * Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.6-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
 
diff --git a/sources b/sources
index a9715d1..f413a1e 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (aubio-0.4.6.tar.bz2) = 0e5cab0c88d51f2fb70c0d85e1c067a7b3758fbffdbd5026686726379aa36203adb63ed3f8e40c83ea02930e0ffc4e6c246803f1d518d448d47a01984678e77d
+SHA512 (aubio-0.4.9.tar.bz2) = 0cb81bb4b15051db3f3f4d160d500af56fdfb237e0a74e3f366f53c2870030aa0a7cee8469a611a9694c36b8866d3d42ffb48241c999de08f3fee43e6d903130