diff --git a/gdm.spec b/gdm.spec
index f462f3a..e52c8a7 100644
--- a/gdm.spec
+++ b/gdm.spec
@@ -16,7 +16,7 @@
 Summary: The GNOME Display Manager
 Name: gdm
 Version: 2.20.0
-Release: 10%{?dist}
+Release: 11%{?dist}
 Epoch: 1
 License: GPLv2+
 Group: User Interface/X
@@ -64,6 +64,9 @@ Patch39: gdm-2.20.0-fix-savedie.patch
 # http://bugzilla.gnome.org/show_bug.cgi?id=453916
 Patch40: gdm-2.20.0-fix-default-language.patch
 
+# http://bugzilla.gnome.org/show_bug.cgi?id=482348
+Patch41: pixbuf-ref.patch
+
 Patch100: gdm-2.20.0-change-defaults.patch
 Patch101: stupid-bullets.patch
 
@@ -152,6 +155,7 @@ Extra icons / faces for the GNOME Display Manager.
 %patch38 -p1 -b .hang
 %patch39 -p1 -b .fix-savedie
 %patch40 -p1 -b .fix-default-language
+%patch41 -p1 -b .pixbuf-ref
 
 %patch100 -p1 -b .change-defaults
 %patch101 -p1 -b .stupid-bullets
@@ -365,6 +369,9 @@ fi
 %{_datadir}/pixmaps/faces/extras/*.jpg
 
 %changelog
+* Mon Oct  1 2007 Matthias Clasen <mclasen@redhat.com> - 1:2.20.0-11
+- Fix a refcounting problem with user faces
+
 * Mon Oct  1 2007 Ray Strode <rstrode@redhat.com> - 1:2.20.0-10
 - apply upstream patch from Brady Anderson <brady.anderson@gmail.com>
   to fix writing out .dmrc file when setting default language 
diff --git a/pixbuf-ref.patch b/pixbuf-ref.patch
new file mode 100644
index 0000000..96a5dd4
--- /dev/null
+++ b/pixbuf-ref.patch
@@ -0,0 +1,23 @@
+diff -up gdm-2.20.0/gui/gdmuser.c.pixbuf-ref gdm-2.20.0/gui/gdmuser.c
+--- gdm-2.20.0/gui/gdmuser.c.pixbuf-ref	2007-10-01 15:27:00.000000000 -0400
++++ gdm-2.20.0/gui/gdmuser.c	2007-10-01 15:28:29.000000000 -0400
+@@ -142,6 +142,9 @@ gdm_user_alloc (const gchar *logname,
+ 
+ 		img = gdk_pixbuf_loader_get_pixbuf (loader);
+ 
++		if (img != NULL)
++			g_object_ref (img);
++
+ 		/* if we have a defface, force all faces to be this size */
+ 		if (img != NULL && defface != NULL) {
+ 			GdkPixbuf *scaled;
+@@ -155,9 +158,6 @@ gdm_user_alloc (const gchar *logname,
+ 			}
+ 		}
+ 
+-		if (img != NULL)
+-			g_object_ref (G_OBJECT (img));
+-
+ 		g_object_unref (G_OBJECT (loader));
+ 
+ 		/* read the "done" bit, but don't check */