diff --git a/.cvsignore b/.gitignore
similarity index 100%
rename from .cvsignore
rename to .gitignore
diff --git a/Makefile b/Makefile
deleted file mode 100644
index bbb4ba8..0000000
--- a/Makefile
+++ /dev/null
@@ -1,21 +0,0 @@
-# Makefile for source rpm: xar
-# $Id: Makefile,v 1.1 2007/06/05 23:17:48 tibbs Exp $
-NAME := xar
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attept a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)
diff --git a/xar-1.5.2-CVE-2010-0055.patch b/xar-1.5.2-CVE-2010-0055.patch
new file mode 100644
index 0000000..8be4389
--- /dev/null
+++ b/xar-1.5.2-CVE-2010-0055.patch
@@ -0,0 +1,49 @@
+Index: xar/lib/archive.c
+===================================================================
+--- xar/lib/archive.c	(revision 224)
++++ xar/lib/archive.c	(revision 225)
+@@ -330,6 +330,44 @@
+ 
+ 		EVP_DigestFinal(&XAR(ret)->toc_ctx, toccksum, &tlen);
+ 
++		const char *value;
++		uint64_t offset = 0;
++		uint64_t length = tlen;
++		if( xar_prop_get( XAR_FILE(ret) , "checksum/offset", &value) == 0 ) {
++			errno = 0;
++			offset = strtoull( value, (char **)NULL, 10);
++			if( errno != 0 ) {
++				xar_close(ret);
++				return NULL;
++			}
++		} else if( xar_signature_first(ret) != NULL ) {
++			// All archives that have a signature also specify the location
++			// of the checksum.  If the location isn't specified, error out.
++			xar_close(ret);
++			return NULL;
++		}
++
++		XAR(ret)->heap_offset = xar_get_heap_offset(ret) + offset;
++		if( lseek(XAR(ret)->fd, XAR(ret)->heap_offset, SEEK_SET) == -1 ) {
++			xar_close(ret);
++			return NULL;
++		}
++		if( xar_prop_get( XAR_FILE(ret) , "checksum/size", &value) == 0 ) {
++			errno = 0;
++			length = strtoull( value, (char **)NULL, 10);
++			if( errno != 0 ) {
++				xar_close(ret);
++				return NULL;
++			}
++		} else if( xar_signature_first(ret) != NULL ) {
++			xar_close(ret);
++			return NULL;
++		}
++		if( length != tlen ) {
++			xar_close(ret);
++			return NULL;
++		}
++
+ 		xar_read_fd(XAR(ret)->fd, cval, tlen);
+ 		XAR(ret)->heap_offset += tlen;
+ 		if( memcmp(cval, toccksum, tlen) != 0 ) {
diff --git a/xar.spec b/xar.spec
index 37f137e..b732621 100644
--- a/xar.spec
+++ b/xar.spec
@@ -1,12 +1,13 @@
 Summary: The eXtensible ARchiver
 Name: xar
 Version: 1.5.2
-Release: 5%{?dist}
+Release: 6%{?dist}
 License: BSD
 Group: Applications/Archiving
 URL: http://code.google.com/p/xar/
 Source: http://xar.googlecode.com/files/xar-%{version}.tar.gz
 Patch0: xar-1.5-norpath.patch
+Patch1: xar-1.5.2-CVE-2010-0055.patch
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
 BuildRequires: libxml2-devel
 BuildRequires: openssl-devel
@@ -37,6 +38,7 @@ Development files for the eXtensible ARchiver.
 %prep
 %setup -q
 %patch0 -p1 -b .norpath
+%patch1 -p1 -b .CVE-2010-0055
 
 
 %build
@@ -73,6 +75,9 @@ Development files for the eXtensible ARchiver.
 
 
 %changelog
+* Wed Apr 28 2010 Matthias Saou <http://freshrpms.net/> 1.5.2-6
+- Include patch to fix CVE-2010-0055 (#570678).
+
 * Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 1.5.2-5
 - rebuilt with new openssl