diff --git a/.gitignore b/.gitignore
index a4e39ab..9483d6f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,4 @@
 /mujs-4006739.tar.gz
 /mujs-25821e6.tar.gz
 /mujs-1.0.4.tar.gz
+/1.0.9.tar.gz
diff --git a/mujs.spec b/mujs.spec
index a272dc9..a58ed77 100644
--- a/mujs.spec
+++ b/mujs.spec
@@ -1,10 +1,12 @@
 Name:           mujs
-Version:        1.0.4
-Release:        6%{?dist}
+Version:        1.0.9
+Release:        1%{?dist}
 Summary:        An embeddable Javascript interpreter
 License:        AGPLv3+
 URL:            http://mujs.com/
-Source0:        https://mujs.com/downloads/%{name}-%{version}.tar.gz
+# The mujs.com download page doesn't provide recent tarballs
+# Github mirror of mujs.com repository provides releases from tags
+Source0:        https://github.com/ccxvii/mujs/archiv/%{version}.tar.gz
 BuildRequires:  coreutils
 BuildRequires:  gcc
 BuildRequires:  grep
@@ -27,13 +29,11 @@ This package provides the MuJS static library.
 chmod a-x -v docs/*
 
 %build
-make debug %{?_smp_mflags} CFLAGS="%{optflags} -fPIC" LDFLAGS="%{?__global_ldflags}"
+make debug %{?_smp_mflags} XCFLAGS="%{optflags} -fPIC" LDFLAGS="%{?__global_ldflags}"
 
 %install
 make install DESTDIR=%{buildroot} prefix="%{_prefix}" libdir="%{_libdir}" \
- CFLAGS="%{optflags} -fPIC" LDFLAGS="%{?__global_ldflags}"
-
-%global _docdir_fmt %{name}
+ XCFLAGS="%{optflags} -fPIC" LDFLAGS="%{?__global_ldflags}"
 
 %files
 %license COPYING
@@ -48,6 +48,10 @@ make install DESTDIR=%{buildroot} prefix="%{_prefix}" libdir="%{_libdir}" \
 %{_libdir}/lib%{name}.a
 
 %changelog
+* Sat Oct 31 2020 Petr Šabata <contyk@redhat.com> - 1.0.9-1
+- 1.0.9 bump
+- Addresses CVE-2019-11411, CVE-2019-11412 and CVE-2019-11413
+
 * Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.4-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 
diff --git a/sources b/sources
index 121b8ff..0643c92 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (mujs-1.0.4.tar.gz) = ee88012c22265532de1b9154f39e5a2905bdb8fcd739a0176cfa4a53ae2025d5d142964afe852cdeec47553f8aa2612b24333e4d63287b540bd472ce858aaa60
+SHA512 (1.0.9.tar.gz) = a3dbc8dbf5c16b7de9803954fe38ea9f77c0e5b7de3895966ec0877e063d463c9950499791ea0d102e464bd0426413689f3edb15e38db3f13915d72f27556725