diff --git a/.cvsignore b/.cvsignore
index fa01b83..96793d9 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,4 +1,4 @@
 config-4.tar.bz2
 libbind-man.tar.gz
 bind-chroot.tar.bz2
-bind-9.5.1-P2.tar.gz
+bind-9.5.1-P3.tar.gz
diff --git a/bind.spec b/bind.spec
index e1fa778..54cf41a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -4,7 +4,7 @@
 
 #%define PREVER b3
 #%define VERSION %{version}%{PREVER}
-%define PATCHVER P2
+%define PATCHVER P3
 %define VERSION %{version}-%{PATCHVER}
 
 %{?!SDB:       %define SDB       1}
@@ -21,7 +21,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  ISC
 Version:  9.5.1
-Release:  2.%{PATCHVER}%{?dist}
+Release:  3.%{PATCHVER}%{?dist}
 Epoch:    32
 Url:      http://www.isc.org/products/BIND/
 Buildroot:%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -638,6 +638,9 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_sbindir}/bind-chroot-admin
 
 %changelog
+* Wed Jul 29 2009 Adam Tkac <atkac redhat com> 32:9.5.1-3.P3
+- 9.5.1-P3 release (CVE-2009-0696)
+
 * Mon Mar 23 2009 Adam Tkac <atkac redhat com> 32:9.5.1-2.P2
 - 9.5.1-P2 release (handle unknown DLV algorithms well)
 - logrotate configuration file now points to /var/named/data/named.run by
diff --git a/sources b/sources
index ddd183c..a130bd8 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
 de68e10e91e05ab100be879b5bcaa6cb  config-4.tar.bz2
 13fef79f99fcefebb51d84b08805de51  libbind-man.tar.gz
 4faa4395b955e5f8a3d50f308b9fabc8  bind-chroot.tar.bz2
-0778fe5dbf8ef8477032e9f6a33ed9b0  bind-9.5.1-P2.tar.gz
+a25a93711c2498bca7e8f208aab0c896  bind-9.5.1-P3.tar.gz