diff --git a/nss-pem-bug483855.patch b/nss-pem-bug483855.patch
new file mode 100644
index 0000000..346cdb3
--- /dev/null
+++ b/nss-pem-bug483855.patch
@@ -0,0 +1,15 @@
+diff -ruNp mozilla.orig/security/nss/lib/ckfw/pem/pobject.c mozilla/security/nss/lib/ckfw/pem/pobject.c
+--- mozilla.orig/security/nss/lib/ckfw/pem/pobject.c	2009-02-28 15:03:36.719964516 +0100
++++ mozilla/security/nss/lib/ckfw/pem/pobject.c	2009-02-28 15:03:55.964074075 +0100
+@@ -987,10 +987,7 @@ pem_CreateObject
+     char *ivstring = NULL;
+ 
+     count = pem_nobjs;
+-    if (count > 0)
+-        size = ((count / PEM_ITEM_CHUNK) + 1) * PEM_ITEM_CHUNK;
+-    else
+-        size = 0;
++    size = (count / PEM_ITEM_CHUNK) * PEM_ITEM_CHUNK;
+ 
+     /*
+      * only create token objects
diff --git a/nss.spec b/nss.spec
index d724091..f8de4b5 100644
--- a/nss.spec
+++ b/nss.spec
@@ -4,7 +4,7 @@
 Summary:          Network Security Services
 Name:             nss
 Version:          3.12.2.99.3
-Release:          2%{?dist}
+Release:          3%{?dist}
 License:          MPLv1.1 or GPLv2+ or LGPLv2+
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Group:            System Environment/Libraries
@@ -31,6 +31,7 @@ Source12:         %{name}-pem-20080124.tar.bz2
 
 Patch1:           nss-no-rpath.patch
 Patch2:           nss-nolocalsql.patch
+Patch4:           nss-pem-bug483855.patch
 Patch5:           nss-pem-bug429175.patch
 Patch6:           nss-enable-pem.patch
 
@@ -86,6 +87,7 @@ low level services.
 
 %patch1 -p0
 %patch2 -p0
+%patch4 -p0 -b .483855
 %patch5 -p0 -b .429175
 %patch6 -p0 -b .libpem
 
@@ -448,6 +450,8 @@ done
 
 
 %changelog
+* Tue Mar 31 2009 Kai Engert <kaie@redhat.com> - 3.12.2.99.3-3
+- add upstream patch to fix bug 483855
 * Tue Mar 31 2009 Kai Engert <kaie@redhat.com> - 3.12.2.99.3-2
 - build nspr-less freebl library
 * Tue Mar 31 2009 Kai Engert <kaie@redhat.com> - 3.12.2.99.3-1