diff --git a/ksh.changes b/ksh.changes
index 7e62690..c746560 100644
--- a/ksh.changes
+++ b/ksh.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Mon Feb 27 15:24:02 UTC 2012 - werner@suse.de
+
+- Add CLOEXEC flag on file descriptors for pipe handling (bnc#704898)
+
 -------------------------------------------------------------------
 Fri Feb 24 11:38:56 UTC 2012 - werner@suse.de
 
diff --git a/ksh.spec b/ksh.spec
index fbbabe3..162c6be 100644
--- a/ksh.spec
+++ b/ksh.spec
@@ -100,6 +100,7 @@ Patch21:        ksh93-vm.dif
 Patch22:        ksh93-limit-name-len.dif
 Patch23:        ksh93-foreground-prgrp.dif
 Patch24:        ksh93-builtin.dif
+Patch25:        ksh93-twelve-cloexec.dif
 Patch42:        ksh-locale.patch
 
 %description
@@ -178,6 +179,7 @@ fi
 %patch22
 %patch23
 %patch24
+%patch25
 
 %build
   #
diff --git a/ksh93-twelve-cloexec.dif b/ksh93-twelve-cloexec.dif
new file mode 100644
index 0000000..4a042b0
--- /dev/null
+++ b/ksh93-twelve-cloexec.dif
@@ -0,0 +1,10 @@
+--- src/cmd/ksh93/sh/xec.c
++++ src/cmd/ksh93/sh/xec.c	2012-02-27 16:06:17.838506198 +0100
+@@ -108,6 +108,7 @@ static void iousepipe(Shell_t *shp)
+ 	usepipe++;
+ 	fcntl(subpipe[0],F_SETFD,FD_CLOEXEC);
+ 	subpipe[2] = fcntl(1,F_DUPFD,10);
++	fcntl(subpipe[2],F_SETFD,FD_CLOEXEC);
+ 	shp->fdstatus[subpipe[2]] = shp->fdstatus[1];
+ 	close(1);
+ 	fcntl(subpipe[1],F_DUPFD,1);