diff --git a/nss-pem-bug483855.patch b/nss-pem-bug483855.patch
new file mode 100644
index 0000000..346cdb3
--- /dev/null
+++ b/nss-pem-bug483855.patch
@@ -0,0 +1,15 @@
+diff -ruNp mozilla.orig/security/nss/lib/ckfw/pem/pobject.c mozilla/security/nss/lib/ckfw/pem/pobject.c
+--- mozilla.orig/security/nss/lib/ckfw/pem/pobject.c	2009-02-28 15:03:36.719964516 +0100
++++ mozilla/security/nss/lib/ckfw/pem/pobject.c	2009-02-28 15:03:55.964074075 +0100
+@@ -987,10 +987,7 @@ pem_CreateObject
+     char *ivstring = NULL;
+ 
+     count = pem_nobjs;
+-    if (count > 0)
+-        size = ((count / PEM_ITEM_CHUNK) + 1) * PEM_ITEM_CHUNK;
+-    else
+-        size = 0;
++    size = (count / PEM_ITEM_CHUNK) * PEM_ITEM_CHUNK;
+ 
+     /*
+      * only create token objects
diff --git a/nss.spec b/nss.spec
index 8c5f49c..4c32451 100644
--- a/nss.spec
+++ b/nss.spec
@@ -5,7 +5,7 @@
 Summary:          Network Security Services
 Name:             nss
 Version:          3.12.2.0
-Release:          2%{?dist}
+Release:          3%{?dist}
 License:          MPLv1.1 or GPLv2+ or LGPLv2+
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Group:            System Environment/Libraries
@@ -33,6 +33,7 @@ Source12:         %{name}-pem-20080124.tar.bz2
 
 Patch1:           nss-no-rpath.patch
 Patch2:           nss-nolocalsql.patch
+Patch4:           nss-pem-bug483855.patch
 Patch5:           nss-pem-bug429175.patch
 Patch6:           nss-enable-pem.patch
 
@@ -88,6 +89,7 @@ low level services.
 
 %patch1 -p0
 %patch2 -p0
+%patch4 -p0 -b .483855
 %patch5 -p0 -b .429175
 %patch6 -p0 -b .libpem
 
@@ -446,6 +448,8 @@ done
 
 
 %changelog
+* Tue Mar 31 2009 Kai Engert <kaie@redhat.com> - 3.12.2.0-3
+- add upstream patch to fix bug 483855
 * Fri Jan 23 2009 Kai Engert <kengert@redhat.com> - 3.12.2.0-2
 - Update to NSS_3_12_2_WITH_CKBI_1_73_RTM
 * Wed Nov 19 2008 Kai Engert <kengert@redhat.com> - 3.12.2.0-1.1