diff --git a/mozilla-nss.changes b/mozilla-nss.changes
index 394cfa2..07ffa39 100644
--- a/mozilla-nss.changes
+++ b/mozilla-nss.changes
@@ -1,3 +1,22 @@
+-------------------------------------------------------------------
+Mon Dec 10 21:39:03 UTC 2018 - Wolfgang Rosenauer <wr@rosenauer.org>
+
+- update to NSS 3.40.1
+  * required by Firefox 64.0
+  * patch release fixes CVE-2018-12404
+  Notable bug fixes
+  * FFDHE key exchange sometimes fails with decryption failure (bmo#1478698)
+  New functionality
+  * The draft-00 version of encrypted SNI support is implemented
+  * tstclnt now takes -N option to specify encrypted SNI key
+  Notable changes
+  * The mozilla::pkix library has been ported from Mozilla PSM to NSS.
+    This is a C++ library for building certification paths.
+    mozilla::pkix APIs are not exposed in the libraries NSS builds.
+  * It is easier to build NSS on Windows in mozilla-build environments
+  * The following CA certificates were Removed:
+    CN = Visa eCommerce Root
+
 -------------------------------------------------------------------
 Sun Oct 21 07:39:58 UTC 2018 - wr@rosenauer.org
 
diff --git a/mozilla-nss.spec b/mozilla-nss.spec
index d9eb6b5..8169aa5 100644
--- a/mozilla-nss.spec
+++ b/mozilla-nss.spec
@@ -25,7 +25,7 @@ BuildRequires:  mozilla-nspr-devel >= 4.20
 BuildRequires:  pkg-config
 BuildRequires:  sqlite-devel
 BuildRequires:  zlib-devel
-Version:        3.39
+Version:        3.40.1
 Release:        0
 # bug437293
 %ifarch ppc64
@@ -36,8 +36,8 @@ Summary:        Network Security Services
 License:        MPL-2.0
 Group:          System/Libraries
 Url:            http://www.mozilla.org/projects/security/pki/nss/
-Source:         https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_39_RTM/src/nss-%{version}.tar.gz
-# hg clone https://hg.mozilla.org/projects/nss nss-3.39/nss ; cd nss-3.39/nss ; hg up NSS_3_39_RTM
+Source:         https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_40_1_RTM/src/nss-%{version}.tar.gz
+# hg clone https://hg.mozilla.org/projects/nss nss-3.40.1/nss ; cd nss-3.40.1/nss ; hg up NSS_3_40_1_RTM
 #Source:         nss-%{version}.tar.gz
 Source1:        nss.pc.in
 Source3:        nss-config.in
diff --git a/nss-3.39.tar.gz b/nss-3.39.tar.gz
deleted file mode 100644
index 6bee752..0000000
--- a/nss-3.39.tar.gz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:6be64dd76f212415cc8bc34343ac1e7389048db4db9a023a84873c411dc5864b
-size 23048561
diff --git a/nss-3.40.1.tar.gz b/nss-3.40.1.tar.gz
new file mode 100644
index 0000000..fb16f1c
--- /dev/null
+++ b/nss-3.40.1.tar.gz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:5e0e6bae2a79c86e506684955d736bfe875ec5a8e95ed3e4ba0852d1aec2c8f1
+size 23311074