diff --git a/.gitignore b/.gitignore
index 7e5bd23..525ff56 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,4 @@ clog
 /wordpress-3.9.1.tar.gz
 /wordpress-3.9.2.tar.gz
 /wordpress-4.0.tar.gz
+/wordpress-4.0.1.tar.gz
diff --git a/sources b/sources
index 291c56d..c7ce5b4 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-cf235297b802fe987e444759bf30c1db  wordpress-4.0.tar.gz
+531d9a4829fc40d81f5ee4a681f71f94  wordpress-4.0.1.tar.gz
diff --git a/wordpress-4.0-systemlibs.patch b/wordpress-4.0-systemlibs.patch
new file mode 100644
index 0000000..9d16ee6
--- /dev/null
+++ b/wordpress-4.0-systemlibs.patch
@@ -0,0 +1,21 @@
+diff -up wordpress/wp-admin/includes/media.php.old wordpress/wp-admin/includes/media.php
+--- wordpress/wp-admin/includes/media.php.old	2014-09-30 08:54:21.666519693 +0200
++++ wordpress/wp-admin/includes/media.php	2014-09-30 08:55:11.247757421 +0200
+@@ -2907,7 +2907,7 @@ function wp_read_video_metadata( $file )
+ 	$metadata = array();
+ 
+ 	if ( ! class_exists( 'getID3' ) )
+-		require( ABSPATH . WPINC . '/ID3/getid3.php' );
++		require( '/usr/share/php/getid3/getid3.php' );
+ 	$id3 = new getID3();
+ 	$data = $id3->analyze( $file );
+ 
+@@ -2962,7 +2962,7 @@ function wp_read_audio_metadata( $file )
+ 	$metadata = array();
+ 
+ 	if ( ! class_exists( 'getID3' ) )
+-		require( ABSPATH . WPINC . '/ID3/getid3.php' );
++		require( '/usr/share/php/getid3/getid3.php' );
+ 	$id3 = new getID3();
+ 	$data = $id3->analyze( $file );
+ 
diff --git a/wordpress.spec b/wordpress.spec
index 4dcf2a9..7cef0d7 100644
--- a/wordpress.spec
+++ b/wordpress.spec
@@ -6,11 +6,17 @@
 %else
 %global with_cacert 1
 %endif
+# https://bugzilla.redhat.com/1147817 php53-getid3 review
+%if 0%{?fedora} >= 17 || 0%{?rhel} >= 6
+%global with_getid3 1
+%else
+%global with_getid3 0
+%endif
 
 Summary:    Blog tool and publishing platform
 URL:        http://www.wordpress.org
 Name:       wordpress
-Version:    4.0
+Version:    4.0.1
 Group:      Applications/Publishing
 Release:    1%{?dist}
 License:    GPLv2
@@ -45,6 +51,8 @@ Patch5: wordpress-4.0-config.patch
 # change DISALLOW_FILE_MODS default value to true
 # ignore WP_AUTO_UPDATE_CORE (always false)
 Patch6: wordpress-4.0-noupdate.patch
+# Use system libraries
+Patch7: wordpress-4.0-systemlibs.patch
 
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildArch: noarch
@@ -52,9 +60,15 @@ BuildArch: noarch
 %if 0%{?rhel} == 5
 Requires: php53 >= 5.2.4
 Requires: php53-simplepie >= 1.3.1
+%if %{with_getid3}
+Requires: php53-getid3
+%endif
 %else
 Requires: php >= 5.2.4
 Requires: php-simplepie >= 1.3.1
+%if %{with_getid3}
+Requires: php-getid3
+%endif
 %endif
 # From phpcompatinfo report for version 3.8
 Requires: php-curl
@@ -132,6 +146,9 @@ rm wp-content/plugins/akismet/.htaccess
 %patch2 -p1
 %patch3 -p1
 %patch4 -p1
+%if %{with_getid3}
+%patch7 -p1
+%endif
 
 # We patch a .js file, used patched file instead of unpatch minified one
 ln -sf plugin.js wp-includes/js/tinymce/plugins/media/plugin.min.js
@@ -187,12 +204,12 @@ find ${RPM_BUILD_ROOT} -type f -empty -exec rm -vf {} \;
 rm -f ${RPM_BUILD_ROOT}%{_datadir}/wordpress/{license.txt,readme.html}
 
 # Remove bundled php-simplepie and link to system copy
-rm     ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-simplepie.php
-rm -rf ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/SimplePie
+rm    ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-simplepie.php
+rm -r ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/SimplePie
 %if 0%{?rhel} == 5
-ln -sf /usr/share/php/php53-simplepie/autoloader.php \
+ln -s /usr/share/php/php53-simplepie/autoloader.php \
 %else
-ln -sf /usr/share/php/php-simplepie/autoloader.php \
+ln -s /usr/share/php/php-simplepie/autoloader.php \
 %endif
        ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-simplepie.php
 
@@ -204,6 +221,11 @@ for fic in phpmailer smtp; do
          ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/class-$fic.php
 done
 
+%if %{with_getid3}
+# Remove bundled php-getid3
+rm -r ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/ID3
+%endif
+
 # Remove bundled ca-bundle.crt
 %if %{with_cacert}
 rm ${RPM_BUILD_ROOT}%{_datadir}/wordpress/wp-includes/certificates/ca-bundle.crt
@@ -228,6 +250,7 @@ find ${RPM_BUILD_ROOT} \( -name \*.dolly -o -name \*.rhbz522897 -o -name \*.orig
 #/sbin/restorecon -R %{_localstatedir}/www/wordpress/
 #fi
 
+
 %clean
 rm -rf ${RPM_BUILD_ROOT}
 
@@ -257,6 +280,10 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_datadir}/wordpress/xmlrpc.php
 
 %changelog
+* Fri Nov 21 2014 Remi Collet <remi@fedoraproject.org> - 4.0.1-1
+- WordPress 4.0.1 Security Release
+- use system php-getid3 when available #1145574
+
 * Mon Sep  8 2014 Remi Collet <remi@fedoraproject.org> - 4.0-1
 - WordPress 4.0 “Benny”