diff --git a/pam_mount-0.18-fix-pmvarrun-ref-count.dif b/pam_mount-0.18-fix-pmvarrun-ref-count.dif
new file mode 100644
index 0000000..1340569
--- /dev/null
+++ b/pam_mount-0.18-fix-pmvarrun-ref-count.dif
@@ -0,0 +1,39 @@
+diff -ur ../pam_mount-0.18/src/pam_mount.c ./src/pam_mount.c
+--- src/pam_mount.c	2007-03-12 12:01:49.000000000 -0400
++++ src/pam_mount.c	2007-03-12 11:01:53.000000000 -0400
+@@ -328,7 +328,7 @@
+ 	log_argv(_argv);
+ 
+         if(!spawn_apS(NULL, _argv, NULL, G_SPAWN_DO_NOT_REAP_CHILD, set_myuid,
+-         user, &pid, NULL, &cstdout, NULL, &err)) {
++         NULL, &pid, NULL, &cstdout, NULL, &err)) {
+ 		l0g(PMPREFIX "error executing /usr/sbin/pmvarrun\n");
+ 		fnval = -1;
+ 		goto _return;
+diff -ur ../pam_mount-0.18/src/pmvarrun.c ./src/pmvarrun.c
+--- src/pmvarrun.c	2006-07-28 18:43:41.000000000 -0400
++++ src/pmvarrun.c	2007-03-12 12:02:22.000000000 -0400
+@@ -95,6 +95,11 @@
+     return;
+ }
+ 
++static int user_sanity_check (const char *user) 
++{
++	size_t len = strlen(user);
++	return strstr(user, "../") || user[0] == '-' || user[len - 1] == '/';
++}
+ 
+ /*  parse_args
+     @argc:      number of elements in @argv
+@@ -129,6 +134,11 @@
+                         usage(EXIT_FAILURE, "count string is not valid");
+ 			break;
+ 		case 'u':
++			if (user_sanity_check (optarg)) {
++				fprintf(stderr, "Invalid user name\n");
++				exit (EXIT_FAILURE);
++			}
++
+ 			g_strlcpy(settings->user, optarg,
+ 				  sizeof(settings->user));
+ 			break;
diff --git a/pam_mount.changes b/pam_mount.changes
index ac09240..481a639 100644
--- a/pam_mount.changes
+++ b/pam_mount.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Tue Mar 13 10:18:26 CET 2007 - mc@suse.de
+
+- fix reference counting of pmvarrun app
+  [#252243]
+
 -------------------------------------------------------------------
 Tue Jan 23 17:13:45 CET 2007 - mc@suse.de
 
diff --git a/pam_mount.spec b/pam_mount.spec
index 5a7dc4a..bd84f3e 100644
--- a/pam_mount.spec
+++ b/pam_mount.spec
@@ -14,7 +14,7 @@ Name:           pam_mount
 BuildRequires:  glib2-devel openssl-devel pam-devel
 Summary:        A PAM Module that can Mount Volumes for a User Session.
 Version:        0.18
-Release:        32
+Release:        37
 License:        GNU Library General Public License v. 2.0 and 2.1 (LGPL)
 Prefix:         /usr
 Group:          System/Libraries
@@ -23,6 +23,7 @@ Patch0:         pam_mount-chownuid-fix.diff
 Patch1:         pam_mount-0.18-umount-home-dir.dif
 Patch2:         pam_mount-0.18-bump-max-par.diff
 Patch3:         pam_mount-0.18-disable-debug.diff
+Patch4:         pam_mount-0.18-fix-pmvarrun-ref-count.dif
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 URL:            http://pam-mount.sourceforge.net/
 
@@ -61,6 +62,7 @@ include it and send me patches.
 %patch1
 %patch2
 %patch3
+%patch4
 
 %build
 CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing" ./configure \
@@ -99,7 +101,10 @@ rm -rf $RPM_BUILD_ROOT
 %doc %{_mandir}/man8/pmvarrun.8.gz
 %doc %{_mandir}/man8/umount.crypt.8.gz
 
-%changelog -n pam_mount
+%changelog
+* Tue Mar 13 2007 - mc@suse.de
+- fix reference counting of pmvarrun app
+  [#252243]
 * Tue Jan 23 2007 - mc@suse.de
 - fix umount encrypted homedirectories
   [#237793]