diff --git a/libpng-1.6.26.tar.xz b/libpng-1.6.26.tar.xz
deleted file mode 100644
index 025a8c4..0000000
--- a/libpng-1.6.26.tar.xz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:266743a326986c3dbcee9d89b640595f6b16a293fd02b37d8c91348d317b73f9
-size 983576
diff --git a/libpng-1.6.26.tar.xz.asc b/libpng-1.6.26.tar.xz.asc
deleted file mode 100644
index 888fcb7..0000000
--- a/libpng-1.6.26.tar.xz.asc
+++ /dev/null
@@ -1,17 +0,0 @@
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v1
-
-iQIcBAABAgAGBQJYCBZzAAoJEPVJhL+hbGQPvpEP/1WksEMqpKn1w18pbYzTEUe0
-+7WaHKj07Z8zOneYRKdEp3xPtEfvJOS3n+Qr6yqaXo9+SewoKCvagT2B6RhEPeBe
-lpSofPxz3NRqIrD85DRf+BSAky709qYfCXGlNxWoVGCv9r1vDZTOxiUyz+gZkHot
-KuFKNSxTkRGgiFDLl/1ffL1WFv6rEsqQQh5Z54gia8n/z4MAjkxQorwsIVMKPFTw
-KJqWgKpccKSFdBunBdOoHuIbAg871rLdA3ZCR4EOdLBEGyp8APp0Vgfftma1exzF
-oU6ExlTBceBg8jZFwesQISLZMpClyuZrfrI5FEaADWHSmnv7OqJW8H+HyTxt+JFq
-4HCJa0ftLuH6QVmEMnssrq4Ey7Mel6I28nZcUMFyhDdzRJaipwnrfP2zw+X40I+q
-NlELebAdrtBjtOQyr1MrRV50Q8oFcK/+TfMtEaosVGxPnMRmhzmKM/golawFEInK
-gaAGzSm5kSaxtn7Mis2nLiYqE+dbi5qOIKQIedUfxZ92HaKKjGMiXgvru8WPTxZ6
-QRciRsIdHfwxdblUMzjt8SpT1H2UH4zJr/DcPt2YrJYARi5n830XqvzDfVQO9J5R
-Uew/8av0Nch0Oco+OuivAybOJ9b41oOXFyh/iY7ocqqXwQJltskjN1KwdRZeP4Ny
-NjmcKKFtWnvf8M8bEZ0R
-=Ktgv
------END PGP SIGNATURE-----
diff --git a/libpng-1.6.28.tar.xz b/libpng-1.6.28.tar.xz
new file mode 100644
index 0000000..bf816fd
--- /dev/null
+++ b/libpng-1.6.28.tar.xz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d8d3ec9de6b5db740fefac702c37ffcf96ae46cb17c18c1544635a3852f78f7a
+size 984536
diff --git a/libpng-1.6.28.tar.xz.asc b/libpng-1.6.28.tar.xz.asc
new file mode 100644
index 0000000..03b5cdb
--- /dev/null
+++ b/libpng-1.6.28.tar.xz.asc
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1
+
+iQIcBAABAgAGBQJYbngfAAoJEPVJhL+hbGQP2NsQAMPPyLUkB+NAbrsAHWp+wxrb
+Bn6ZasIPKyG/mzmQIxox+nqxEM8alNDXxiRWntjmaCjhR3vEFeb6WxclNJebHnEg
+GkU52NWfCEQwqCVy/2/WkTAIOenxJ65Chow70NiUVM3BX7f7WiDOItGNTIwDg8m8
+wbaWJ/3RcgFyWH3GUk1jOwsTViwEvq6EVT5xPcJY0tRmhpcAx3BxW/zuxxzL6Rgq
+foI3dex+n4pH0p9iD7Lu5AkOj5eh2cccchKHEsekMSJ+hBBOlnbFk/zao7d9TAAn
+S11nCiI8QvrEXyUAHZcreZcSkTLUhsKsLoKVEZ/lHR3PtQK3l3aFL9jdAFj2t7LT
+E41tHX4zzUw67hYINbbC3VUr8e8j4EVmR6par3CZtYf/CueRGScex95ihAJIPCav
+eMNBzP/MxnbGNRQ/4yLzWe6/HcBcto52SqcfHLmK0GbPsnz5la6bTv4bo/m3SgFH
+Oyn0F+2ngxjzqmgaWg9b3v7TssO4viYITcT79xQYAv7YQ3KfMEfde9gQcQOM9QED
+uKGxWZyC8jnq0Pd1dfTIM9OwMYLXoKD5xBwzgcClbSHs+GPYBX+W2b7q07oY7XrP
+OFdCg7dT1l64Kxmo6PsKQnX1Q5uYWrMbDpAalQEuTe8NEk1ZMc3GlKoZOFBSzNE+
+jHs0LXIeouSeR4UCOeVF
+=UXqZ
+-----END PGP SIGNATURE-----
diff --git a/libpng16.changes b/libpng16.changes
index 96adc11..89f8cc2 100644
--- a/libpng16.changes
+++ b/libpng16.changes
@@ -1,3 +1,13 @@
+-------------------------------------------------------------------
+Fri Jan  6 08:09:23 UTC 2017 - pgajdos@suse.com
+
+- update to 1.6.28: fix build issues
+
+-------------------------------------------------------------------
+Mon Jan  2 11:09:08 UTC 2017 - pgajdos@suse.com
+
+- update to 1.6.27: fixes CVE-2016-10087
+
 -------------------------------------------------------------------
 Thu Oct 20 06:12:20 UTC 2016 - pgajdos@suse.com
 
diff --git a/libpng16.spec b/libpng16.spec
index b869122..99aa7c7 100644
--- a/libpng16.spec
+++ b/libpng16.spec
@@ -1,7 +1,7 @@
 #
 # spec file for package libpng16
 #
-# Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -19,7 +19,7 @@
 #
 %define major   1
 %define minor   6
-%define micro   26
+%define micro   28
 %define branch  %{major}%{minor}
 %define libname libpng%{branch}-%{branch}
 
@@ -44,8 +44,8 @@ BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 
 %package -n %{libname}
 Summary:        Library for the Portable Network Graphics Format (PNG)
-Group:          System/Libraries
 # bug437293
+Group:          System/Libraries
 %ifarch ppc64
 Obsoletes:      libpng-64bit
 %endif