diff --git a/.gitignore b/.gitignore
index 8aaf440..6676b33 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,3 +26,4 @@ samba-3.6.0pre1.tar.gz
 /samba-4.0.5.tar.bz2
 /samba-4.0.6.tar.bz2
 /samba-4.0.7.tar.xz
+/samba-4.0.8.tar.xz
diff --git a/samba.spec b/samba.spec
index 985e111..6c6f269 100644
--- a/samba.spec
+++ b/samba.spec
@@ -1,9 +1,9 @@
 # Set --with testsuite or %bcond_without to run the Samba torture testsuite.
 %bcond_with testsuite
 
-%define main_release 2
+%define main_release 1
 
-%define samba_version 4.0.7
+%define samba_version 4.0.8
 %define talloc_version 2.0.7
 %define ntdb_version 0.9
 %define tdb_version 1.2.12
@@ -1509,6 +1509,12 @@ rm -rf %{buildroot}
 %{_mandir}/man7/winbind_krb5_locator.7*
 
 %changelog
+* Mon Aug 05 2013 - Andreas Schneider <asn@redhat.com> 2:4.0.8-1
+- Update to Samba 4.0.8
+- resolves: #993043 - CVE-2013-4124 [fedora-all]
+- resolves: #984401 - CVE-2013-4124 DoS via integer overflow when reading
+                      an EA list
+
 * Mon Jul 15 2013 - Andreas Schneider <asn@redhat.com> - 2:4.0.7-2
 - resolves: #972692 - Build with PIE and full RELRO.
 - resolves: #884169 - Add explicit dependencies suggested by rpmdiff.
diff --git a/sources b/sources
index fe28473..ae229a2 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-0ad84fca0ba233f66e1224f6131bc2f9  samba-4.0.7.tar.xz
+1966a12e7576bbf9c4b963108741d2df  samba-4.0.8.tar.xz