diff --git a/sources b/sources
index 8677d7a..4d953df 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (tor-0.2.9.10.tar.gz) = c18c4faf18406f04165136f0d70e6bc2896f3f02770beadaab5e7a99441d71b897ae3a14a046eaec99a1bd6d8ad7758b28f7d652588842b77621cdc95d4fb7e1
-SHA512 (tor-0.2.9.10.tar.gz.asc) = 40ba335f960d14558b207489456145d27f8be9e59d3c79eb0c56f4dae599cb19a28edc86456b635c92adf2877ed5665d36e30c93d06d4011e5627d8f612affc6
+SHA512 (tor-0.2.9.11.tar.gz) = bb7ceb416c6cdcf127cb3c45226aa0ce787fba85b6fb59e9c222193c6f2522f2ef85ee0f5062554a4d301ac49d20b68fd82c7ce00406ceae0d00f6ac4107d074
+SHA512 (tor-0.2.9.11.tar.gz.asc) = f8da93761ea54eb7272255a28b33510fd923fda2591699a20af7c005fa3ae14ba4890bb0ccd24919e771e3179c0c2a61f7e41b67ab6a37b458c962cf52139c52
diff --git a/tor.spec b/tor.spec
index 3b75b65..6761d30 100644
--- a/tor.spec
+++ b/tor.spec
@@ -19,8 +19,8 @@
 %endif
 
 Name:       tor
-Version:    0.2.9.10
-Release:    3%{?dist}
+Version:    0.2.9.11
+Release:    1%{?dist}
 Group:      System Environment/Daemons
 License:    BSD
 Summary:    Anonymizing overlay network for TCP
@@ -172,6 +172,11 @@ fi
 
 
 %changelog
+* Fri Aug 04 2017 Marcel Härry <maha+fedora@scrit.ch> - 0.2.9.11-1
+- update to upstream release 0.2.9.11 (SECURITY)
+- CVE-2017-0375 & CVE-2017-0376: denial of service (assertion
+  failure and daemon exit) (#1461276) (#1461275)
+
 * Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.2.9.10-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild