diff --git a/.gitignore b/.gitignore
index 3f4c455..5a97d67 100644
--- a/.gitignore
+++ b/.gitignore
@@ -183,3 +183,5 @@ samba-3.6.0pre1.tar.gz
 /samba-4.11.1.tar.asc
 /samba-4.11.2.tar.xz
 /samba-4.11.2.tar.asc
+/samba-4.11.3.tar.xz
+/samba-4.11.3.tar.asc
diff --git a/samba.spec b/samba.spec
index 5fb4903..3438859 100644
--- a/samba.spec
+++ b/samba.spec
@@ -6,9 +6,9 @@
 # ctdb is enabled by default, you can disable it with: --without clustering
 %bcond_without clustering
 
-%define main_release 2
+%define main_release 0
 
-%define samba_version 4.11.2
+%define samba_version 4.11.3
 %define talloc_version 2.2.0
 %define tdb_version 1.4.2
 %define tevent_version 0.10.0
@@ -3518,6 +3518,11 @@ fi
 %endif
 
 %changelog
+* Tue Dec 10 2019 Guenther Deschner <gdeschner@redhat.com> - 4.11.3-0
+- Update to Samba 4.11.3
+- resolves: #1778586, #1781542 - Security fixes for CVE-2019-14861
+- resolves: #1778589, #1781545 - Security fixes for CVE-2019-14870
+
 * Thu Dec 05 2019 Andreas Schneider <asn@redhat.com> - 4.11.2-2
 - Restart winbindd on samba-winbind package upgrade
 
diff --git a/sources b/sources
index 7c95f4a..7264c8c 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (samba-4.11.2.tar.xz) = 077fa15f8c25560592b4270c2c5b356c4b2f8d63bba664dca67bf7def0b4cf4f2275984c56796161166b9835f4e388c411fb91f3c17537c4b5fb566a21795d12
-SHA512 (samba-4.11.2.tar.asc) = 95c6225008cb3a2361cfab0f9d7138b012e053cb66e2a40a27abc103064b96e05e969d53a31a5c64096a669654564329e4b94dc9f6c99342b53d1def76a6c65f
+SHA512 (samba-4.11.3.tar.xz) = 5a68491af4c4cd53843df7ea12ebd5217776b348c6e1a1023518ac5737615606ed19ab416918e4b43461852b99d1894d0a88fd17420e398a13b273ab869a199e
+SHA512 (samba-4.11.3.tar.asc) = 47e5f538b7e6c182717d29aebf50f0d5e5c0b3ba479b57d8587da2c3f97c865cf02303ec03ed5ac93f098ebc8825b830307844419cfa3e7e89a3fe7b0375251b