diff --git a/apr-1.3.5.tar.bz2.asc b/apr-1.3.5.tar.bz2.asc
deleted file mode 100644
index 128e9c2..0000000
--- a/apr-1.3.5.tar.bz2.asc
+++ /dev/null
@@ -1,17 +0,0 @@
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v1.4.9 (GNU/Linux)
-
-iQIcBAABAgAGBQJKJosLAAoJEIFUZ7bLm57Fe94QAMCm0yundoo+pnhT5dcUR8Ju
-6xU3fSCa5D4hUHSS6ZdyPtT8rmKRtUABhT/TkG8SY8VNLGoRB+ndBxaOyTbmmtRB
-XP2uz7B5VSlsp3svYfSE+YDj6m/OjesWjVhxr++9QMCcRpSvkJviJGMZFNstUF9s
-L8gPJk52ixqD/aiJlzKmL8f1OprTqpt0Isk6Cu7+1SIO4y18+PfluBGwvhjKlX9H
-EwLiJ3/OzA4rBBkAMMSV/EeTLlKlOpZbIJF6NWm3Q3dkTB38niNs/iTalsWG1dHG
-oWpiouK88R2pT/pzu+R9kzpTKY9H0cyuC90LfSotof1oBNm598k5fL3+5cp/zSo1
-OrLDwel20qij5EgsZpgENpOoG4u9aIp/ojkFfXfp1XpP2nxiGIDGsWh4BMbyzb58
-HzD+56p5IfraL8i4nz6JO4sQKbj9ueqaw47D4WYBbQ0DFLXXz/3iftzuTPaTbmU8
-JOcIGu55DQztYGpXXhYb3qDCv9NjzUNn2OTGXRUH5Sr4fu97MSKdUVLFrSdRwvj+
-cJGnhgUQ4WRlHwappMMOyFZn/PsvdsTc2uAhlr35Pi2SCJTrQoLLnKfxG0vJ9yBO
-6qQR61CRqRM8Q5u5Mt6AfG+5NXeoSZUKgHAv02ISzBANWMbeh3bYLCW7WmrKzJN+
-2R135dDXJeVeQ5sql7Ox
-=8czj
------END PGP SIGNATURE-----
diff --git a/apr-1.3.8.tar.bz2.asc b/apr-1.3.8.tar.bz2.asc
new file mode 100644
index 0000000..fb92e73
--- /dev/null
+++ b/apr-1.3.8.tar.bz2.asc
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1.4.9 (GNU/Linux)
+
+iQIcBAABAgAGBQJKeKEWAAoJEKNIuYR/chSn7NUP/iaCorqo2mTGAdW/VJO6sFWZ
+tR874sJPL4/y4bl8OQ9QttDm220u3iApJHps3DtH7lD95OEYJ9p+lAAbiJF+frkj
+8cNorwiH+eHu6yzVmjaYi4svIzEnvqugjdG2jJ3mckjLcM6Xz/JalS0iVpl/hpti
+MZ/HNtPOyjECDN5RQT86cfUboWjwvQb5awXkzdtI9+58xJZ4piDxPexBVud7Eelo
+Ax6UD8gfGXpkloYLFK+cujwYZDKPO6CrizSWULo3Gm/6a/7D3jZCmcmBM4JVexMd
+Umy3KDHBmkE0TEKbEuxoHNOgLT8gI4BnLyt6OGPQHTaY2jjH2TRDLjw/WOYDAR9d
+qYOEWsF4pHwOs2I2IOZI1x5dzBHnajRIxPsd3dEK/pmrKJEccoOOPrq1hNCdiKPp
+9/zLJ8fMoqkxTvPkQQLjSYu3BMLRuK5ET+ULP4Rd+C8zAfztpJigHb7Qxnzi54d3
+oqUqBkSG88IWWn+s9IMmUGem7f9m/9kVfmSSWz7KMsJo3i8Jd8FaGLNsnh7v3qMg
+V9uUof8BaPnFrsX5j7zPyvFv1uYH4FMQKRoxjlvQ26s+jn6H78lncRmDiUT7dsJy
+BGI+1AT/CcIBHrD+UeJtQ26KcAWPnOama7kJgfgdqXbJV4Wp6Pm1ItB668x5ToHk
+GQGu/3OxUAALS20RWacr
+=a7Bb
+-----END PGP SIGNATURE-----
diff --git a/apr.spec b/apr.spec
index b62313d..da0f26d 100644
--- a/apr.spec
+++ b/apr.spec
@@ -5,7 +5,7 @@
 
 Summary: Apache Portable Runtime library
 Name: apr
-Version: 1.3.5
+Version: 1.3.8
 Release: 1%{?dist}
 License: ASL 2.0
 Group: System Environment/Libraries
@@ -121,6 +121,11 @@ rm -rf $RPM_BUILD_ROOT
 %{_datadir}/aclocal/*.m4
 
 %changelog
+* Thu Aug  6 2009 Bojan Smojver <bojan@rexursive.com> - 1.3.8-1
+- bump up to 1.3.8
+- CVE-2009-2412
+- allocator alignment fixes
+
 * Mon Jun  8 2009 Bojan Smojver <bojan@rexursive.com> - 1.3.5-1
 - bump up to 1.3.5
 
diff --git a/sources b/sources
index ef4da24..4b59290 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-9ac9a00eaa190937fdbbde7b4f03ac1e  apr-1.3.5.tar.bz2
+3c7e3a39ae3d3573f49cb74e2dbf87a2  apr-1.3.8.tar.bz2