diff --git a/mutt-1.5.21-hdrcnt.patch b/mutt-1.5.21-hdrcnt.patch
new file mode 100644
index 0000000..48f4786
--- /dev/null
+++ b/mutt-1.5.21-hdrcnt.patch
@@ -0,0 +1,37 @@
+diff -up mutt-1.5.21/imap/message.c.hdrcnt mutt-1.5.21/imap/message.c
+--- mutt-1.5.21/imap/message.c.hdrcnt	2010-08-24 18:34:21.000000000 +0200
++++ mutt-1.5.21/imap/message.c	2011-03-28 14:26:41.059338455 +0200
+@@ -65,7 +65,7 @@ int imap_read_headers (IMAP_DATA* idata,
+   char *hdrreq = NULL;
+   FILE *fp;
+   char tempfile[_POSIX_PATH_MAX];
+-  int msgno, idx;
++  int msgno, idx = -1;
+   IMAP_HEADER h;
+   IMAP_STATUS* status;
+   int rc, mfhrc, oldmsgcount;
+@@ -185,7 +185,7 @@ int imap_read_headers (IMAP_DATA* idata,
+           continue;
+         }
+ 
+-        idx = h.sid - 1;
++        idx++;
+         ctx->hdrs[idx] = imap_hcache_get (idata, h.data->uid);
+         if (ctx->hdrs[idx])
+         {
+@@ -273,13 +273,14 @@ int imap_read_headers (IMAP_DATA* idata,
+       {
+         dprint (2, (debugfile, "msg_fetch_header: ignoring fetch response with no body\n"));
+         mfhrc = -1;
++        msgend--;
+         continue;
+       }
+ 
+       /* make sure we don't get remnants from older larger message headers */
+       fputs ("\n\n", fp);
+ 
+-      idx = h.sid - 1;
++      idx++;
+       if (idx > msgend)
+       {
+         dprint (1, (debugfile, "imap_read_headers: skipping FETCH response for "
diff --git a/mutt.spec b/mutt.spec
index a699e63..8fae0af 100644
--- a/mutt.spec
+++ b/mutt.spec
@@ -16,7 +16,7 @@
 Summary: A text mode mail user agent
 Name: mutt
 Version: 1.5.21
-Release: 3%{?dist}
+Release: 4%{?dist}
 Epoch: 5
 # The entire source code is GPLv2+ except
 # pgpewrap.c setenv.c sha1.c wcwidth.c which are Public Domain
@@ -28,6 +28,7 @@ Patch2: mutt-1.5.13-nodotlock.patch
 Patch3: mutt-1.5.18-muttrc.patch
 Patch4: mutt-1.5.18-manual.patch
 Patch5: mutt-1.5.21-updating.patch
+Patch6: mutt-1.5.21-hdrcnt.patch
 Url: http://www.mutt.org/
 Requires: mailcap urlview
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -68,6 +69,7 @@ for selecting groups of messages.
 %patch3 -p1 -b .muttrc
 %patch4 -p1 -b .manual
 %patch5 -p1 -b .updating
+%patch6 -p1 -b .hdrcnt
 
 sed -i.gpgerror 's/`$GPGME_CONFIG --libs`/"\0 -lgpg-error"/' configure
 
@@ -150,6 +152,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man5/muttrc.*
 
 %changelog
+* Tue Mar 29 2011 Honza Horak <hhorak@redhat.com> - 5:1.5.21-4
+- Fixed segmentation faults during reading message headers (rhbz#676074)
+
 * Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 5:1.5.21-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild