diff --git a/krb5-1.14.2.tar.gz b/krb5-1.14.2.tar.gz
deleted file mode 100644
index 1a1446b..0000000
--- a/krb5-1.14.2.tar.gz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:275e582261e80c464afd80afd0a880b9abcae011fc64be8b1abd7e4c8433c385
-size 12621899
diff --git a/krb5-1.14.3.tar.gz b/krb5-1.14.3.tar.gz
new file mode 100644
index 0000000..6d8962e
--- /dev/null
+++ b/krb5-1.14.3.tar.gz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:cd4620d520cf0df0dd8791309912df2bb20fcba76790b9fba4e25c1da08ff2c9
+size 12279888
diff --git a/krb5-1.14.3.tar.gz.asc b/krb5-1.14.3.tar.gz.asc
new file mode 100644
index 0000000..389755e
--- /dev/null
+++ b/krb5-1.14.3.tar.gz.asc
@@ -0,0 +1,14 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1
+
+iQGcBAABAgAGBQJXj/41AAoJEKMvF/0AVcMFKWkMAIpdTej1sku6sIm39+NjaTDr
+1tPTdRFtX5zb7hFlv4PelZzMWNtylbKmD1WgriTcJ9AGvKY5IexbYrHreEbvHr3s
+hlcnXxhKy4TXWqRyEHQ20K0n2fJYLwJBSVKFM9joCOmfuj2BWPqhh1UxHnNlTsjQ
+k9q1T9iDY2hEiHlIrvLRjiTEZBr/ldr1fzkuAflyDg/7FydjLgl9Jm1HPU08Hofz
+dLh+ozy6hsNTbteTBsngm51iFKSETr5Ugxxba7nXZ7KVaruCawjixDzfQRXgEuh2
+dHAJd6vVOixGcDOxDOSVTy/LaMqERC5K/qc0X2ubjwbPZn798919+szJ90jZwA2j
+19aqxGkOxfHi3LUponAXZ1kgPUbN2x7FIe1byowwnXnAX7i4DJ3HgxWkn5dWnRX3
+ntFsQb5D0YFul5PApXYLpjACQt0gu+WNAwOYDQxSISRkMU5L2yXw7E32qSMdR7j7
+AWZzE8XXuhl8LN/UPxj7+1zOftCOv7xcKtQJgL6Quw==
+=QiOC
+-----END PGP SIGNATURE-----
diff --git a/krb5-mini.changes b/krb5-mini.changes
index b56f077..8a561d2 100644
--- a/krb5-mini.changes
+++ b/krb5-mini.changes
@@ -1,3 +1,15 @@
+-------------------------------------------------------------------
+Fri Jul 22 08:45:19 UTC 2016 - michael@stroeder.com
+
+- Upgrade from 1.14.2 to 1.14.3:
+  * Improve some error messages
+  * Improve documentation
+  * Allow a principal with nonexistent policy to bypass the minimum
+    password lifetime check, consistent with other aspects of
+    nonexistent policies
+  * Fix a rare KDC denial of service vulnerability when anonymous client
+    principals are restricted to obtaining TGTs only [CVE-2016-3120]
+  
 ------------------------------------------------------------------
 Tue May 10 12:41:14 UTC 2016 - hguo@suse.com
 
diff --git a/krb5-mini.spec b/krb5-mini.spec
index 9ec4873..0d4fec1 100644
--- a/krb5-mini.spec
+++ b/krb5-mini.spec
@@ -16,7 +16,7 @@
 #
 
 
-%define srcRoot krb5-1.14.2
+%define srcRoot krb5-1.14.3
 %define vendorFiles %{_builddir}/%{srcRoot}/vendor-files/
 %define krb5docdir  %{_defaultdocdir}/krb5
 
@@ -29,7 +29,7 @@ BuildRequires:  keyutils-devel
 BuildRequires:  libcom_err-devel
 BuildRequires:  libselinux-devel
 BuildRequires:  ncurses-devel
-Version:        1.14.2
+Version:        1.14.3
 Release:        0
 Summary:        MIT Kerberos5 implementation and libraries with minimal dependencies
 License:        MIT
diff --git a/krb5.changes b/krb5.changes
index 2599987..76dea70 100644
--- a/krb5.changes
+++ b/krb5.changes
@@ -1,3 +1,15 @@
+-------------------------------------------------------------------
+Fri Jul 22 08:45:19 UTC 2016 - michael@stroeder.com
+
+- Upgrade from 1.14.2 to 1.14.3:
+  * Improve some error messages
+  * Improve documentation
+  * Allow a principal with nonexistent policy to bypass the minimum
+    password lifetime check, consistent with other aspects of
+    nonexistent policies
+  * Fix a rare KDC denial of service vulnerability when anonymous client
+    principals are restricted to obtaining TGTs only [CVE-2016-3120]
+  
 -------------------------------------------------------------------
 Sat Jul  2 11:38:54 UTC 2016 - idonmez@suse.com
 
diff --git a/krb5.spec b/krb5.spec
index ea0da4c..d25290d 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -25,7 +25,7 @@ BuildRequires:  keyutils-devel
 BuildRequires:  libcom_err-devel
 BuildRequires:  libselinux-devel
 BuildRequires:  ncurses-devel
-Version:        1.14.2
+Version:        1.14.3
 Release:        0
 Summary:        MIT Kerberos5 Implementation--Libraries
 License:        MIT