diff --git a/gimp-2.8.16-CVE-2016-4994.patch b/gimp-2.8.16-CVE-2016-4994.patch
new file mode 100644
index 0000000..aa731ce
--- /dev/null
+++ b/gimp-2.8.16-CVE-2016-4994.patch
@@ -0,0 +1,99 @@
+From 94e49c2beda08a9898775845d93bb3b1412305e8 Mon Sep 17 00:00:00 2001
+From: Nils Philippsen <nils@redhat.com>
+Date: Thu, 30 Jun 2016 11:49:48 +0200
+Subject: [PATCH] patch: CVE-2016-4994
+
+Squashed commit of the following:
+
+commit 9b9acd64de207608ffa47d01ce60a5bdf973148e
+Author: Shmuel H <shmuelgimp@gmail.com>
+Date:   Mon Jun 20 17:14:41 2016 +0300
+
+    Bug 767873 - (CVE-2016-4994) Multiple Use-After-Free when parsing...
+
+    ...XCF channel and layer properties
+
+    The properties PROP_ACTIVE_LAYER, PROP_FLOATING_SELECTION,
+    PROP_ACTIVE_CHANNEL saves the current object pointer the @info
+    structure. Others like PROP_SELECTION (for channel) and
+    PROP_GROUP_ITEM (for layer) will delete the current object and create
+    a new object, leaving the pointers in @info invalid (dangling).
+
+    Therefore, if a property from the first type will come before the
+    second, the result will be an UaF in the last lines of xcf_load_image
+    (when it actually using the pointers from @info).
+
+    I wasn't able to exploit this bug because that
+    g_object_instance->c_class gets cleared by the last g_object_unref and
+    GIMP_IS_{LAYER,CHANNEL} detects that and return FALSE.
+
+    (cherry picked from commit 6d804bf9ae77bc86a0a97f9b944a129844df9395)
+    (cherry picked from commit e82aaa4b4ee0703c879e35ea9321fff6be3e9b6f)
+---
+ app/xcf/xcf-load.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+diff --git a/app/xcf/xcf-load.c b/app/xcf/xcf-load.c
+index b180377..67cc6d4 100644
+--- a/app/xcf/xcf-load.c
++++ b/app/xcf/xcf-load.c
+@@ -904,6 +904,18 @@ xcf_load_layer_props (XcfInfo    *info,
+         case PROP_GROUP_ITEM:
+           {
+             GimpLayer *group;
++            gboolean   is_active_layer;
++
++            /* We're going to delete *layer, Don't leave its pointers
++             * in @info.  After that, we'll restore them back with the
++             * new pointer. See bug #767873.
++             */
++            is_active_layer = (*layer == info->active_layer);
++            if (is_active_layer)
++              info->active_layer = NULL;
++
++            if (*layer == info->floating_sel)
++              info->floating_sel = NULL;
+ 
+             group = gimp_group_layer_new (image);
+ 
+@@ -916,6 +928,13 @@ xcf_load_layer_props (XcfInfo    *info,
+             g_object_ref_sink (*layer);
+             g_object_unref (*layer);
+             *layer = group;
++
++            if (is_active_layer)
++              info->active_layer = *layer;
++
++            /* Don't restore info->floating_sel because group layers
++             * can't be floating selections
++             */
+           }
+           break;
+ 
+@@ -986,6 +1005,12 @@ xcf_load_channel_props (XcfInfo      *info,
+           {
+             GimpChannel *mask;
+ 
++            /* We're going to delete *channel, Don't leave its pointer
++             * in @info. See bug #767873.
++             */
++            if (*channel == info->active_channel)
++              info->active_channel = NULL;
++
+             mask =
+               gimp_selection_new (image,
+                                   gimp_item_get_width  (GIMP_ITEM (*channel)),
+@@ -1000,6 +1025,10 @@ xcf_load_channel_props (XcfInfo      *info,
+             *channel = mask;
+             (*channel)->boundary_known = FALSE;
+             (*channel)->bounds_known   = FALSE;
++
++            /* Don't restore info->active_channel because the
++             * selection can't be the active channel
++             */
+           }
+           break;
+ 
+-- 
+2.5.5
+
diff --git a/gimp.spec b/gimp.spec
index 7959232..467cd0f 100644
--- a/gimp.spec
+++ b/gimp.spec
@@ -82,7 +82,7 @@ Summary:        GNU Image Manipulation Program
 Name:           gimp
 Epoch:          2
 Version:        2.8.16
-Release:        %{?prerelprefix}1%{dotprerel}%{dotgitrev}%{?dist}.1
+Release:        %{?prerelprefix}2%{dotprerel}%{dotgitrev}%{?dist}
 
 # Compute some version related macros.
 # Ugly, need to get quoting percent signs straight.
@@ -202,6 +202,13 @@ Patch0:         gimp-%{version}%{dashprerel}-git%{gitrev}.patch.bz2
 # Fedora specific.
 Patch1:         gimp-2.8.2-cm-system-monitor-profile-by-default.patch
 
+# CVE-2016-4994: Fix multiple use-after-free when parsing XCF channel and layer
+# properties
+# Upstream commit:
+# gimp-2-8: e82aaa4b4ee0703c879e35ea9321fff6be3e9b6f
+# master:   6d804bf9ae77bc86a0a97f9b944a129844df9395
+Patch2:         gimp-2.8.16-CVE-2016-4994.patch
+
 # use external help browser directly if help browser plug-in is not built
 Patch100:       gimp-2.8.6-external-help-browser.patch
 
@@ -291,6 +298,7 @@ EOF
 %endif
 
 %patch1 -p1 -b .cm-system-monitor-profile-by-default
+%patch2 -p1 -b .CVE-2016-4994
 
 %if ! %{with helpbrowser}
 %patch100 -p1 -b .external-help-browser
@@ -652,6 +660,10 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 %endif
 
 %changelog
+* Thu Jun 30 2016 Nils Philippsen <nils@redhat.com> - 2:2.8.16-2
+- fix multiple use-after-free bugs when parsing XCF channel and layer
+  properties (#1348617)
+
 * Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.8.16-1.1
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild