diff --git a/.gitignore b/.gitignore
index 901ac7b..991e51e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,4 @@
 /Django-1.5.5.tar.gz
 /Django-1.6.tar.gz
 /Django-1.6.2.tar.gz
+/Django-1.6.3.tar.gz
diff --git a/python-django.spec b/python-django.spec
index 39a4c65..2b2fc11 100644
--- a/python-django.spec
+++ b/python-django.spec
@@ -16,8 +16,8 @@
 %global         obs_ver 1.5.5-3
 
 Name:           python-django
-Version:        1.6.2
-Release:        2%{?dist}
+Version:        1.6.3
+Release:        1%{?dist}
 Summary:        A high-level Python Web framework
 
 Group:          Development/Languages
@@ -587,6 +587,9 @@ popd
 
 
 %changelog
+* Tue Apr 22 2014 Matthias Runge <mrunge@redhat.com> - 1.6.3-1
+- update to 1.6.3 fixing CVE-2014-0473 and CVE-2014-0474
+
 * Thu Mar 27 2014 Matthias Runge <mrunge@redhat.com> - 1.6.2-2
 - remove simplejson requirement
 - make bash-completion a sub-package, both main packages can require
diff --git a/sources b/sources
index 84949ab..4878c46 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-45d974c623b3bfbf9976f3d808fe1ee9  Django-1.6.2.tar.gz
+727fec03f15db8f80a7231696b79adf7  Django-1.6.3.tar.gz