diff --git a/wireshark-suidflags.patch b/wireshark-suidflags.patch
new file mode 100644
index 0000000..1c2b6dd
--- /dev/null
+++ b/wireshark-suidflags.patch
@@ -0,0 +1,14 @@
+Index: wireshark-1.8.4/Makefile.am
+===================================================================
+--- wireshark-1.8.4.orig/Makefile.am
++++ wireshark-1.8.4/Makefile.am
+@@ -487,7 +487,8 @@ dumpcap_LDADD = \
+ 	@NSL_LIBS@			\
+ 	@CORESERVICES_FRAMEWORKS@	\
+ 	@LIBCAP_LIBS@
+-dumpcap_CFLAGS = $(AM_CLEAN_CFLAGS)
++dumpcap_CFLAGS = $(AM_CLEAN_CFLAGS) $(SUID_CFLAGS)
++dumpcap_LDFLAGS = $(SUID_LDFLAGS)
+ 
+ # Common headers
+ AM_CPPFLAGS = -I$(top_srcdir) -I$(top_srcdir)/wiretap \
diff --git a/wireshark.changes b/wireshark.changes
index be65c99..714263c 100644
--- a/wireshark.changes
+++ b/wireshark.changes
@@ -1,3 +1,12 @@
+-------------------------------------------------------------------
+Mon Dec 10 09:29:02 UTC 2012 - dimstar@opensuse.org
+
+- Add wireshark-suidflags.patch: Allow to pass SUID_{C,LD}FLAGS to
+  introduce -fPIE -pie as needed for suid binaries
+- Add libtool BuildRequires and call to autoreconf, as above patch
+  touches the build system.
+- Export SUID_{C,LD}FLAGS with appropriate flags.
+
 -------------------------------------------------------------------
 Thu Nov 29 20:15:03 UTC 2012 - andreas.stieger@gmx.de
 
diff --git a/wireshark.spec b/wireshark.spec
index 8940dd2..ca543a3 100644
--- a/wireshark.spec
+++ b/wireshark.spec
@@ -34,6 +34,8 @@ Patch1:         %{name}-1.2.0-disable-warning-dialog.patch
 Patch2:         %{name}-1.2.0-geoip.patch
 # PATCH-FIX-OPENSUSE wireshark-1.2.4-enable_lua.patch bnc#650434
 Patch4:         %{name}-1.2.4-enable_lua.patch
+# PATCH-FEATURE-UPSTREAM wireshark-suidflags.patch -- Allow to specify sep. flags for SUID binaries.
+Patch5:         wireshark-suidflags.patch
 BuildRequires:  bison
 BuildRequires:  cairo-devel
 BuildRequires:  flex
@@ -45,6 +47,8 @@ BuildRequires:  libgcrypt-devel
 BuildRequires:  libgnutls-devel
 BuildRequires:  libpcap-devel
 BuildRequires:  libsmi-devel
+# Needed for patch5
+BuildRequires:  libtool
 # required for Lua support in openSUSE 12.2 and later [bnc#780669]
 %if 0%{?suse_version} >= 1220
 BuildRequires:  lua51-devel
@@ -98,6 +102,7 @@ view the reconstructed stream of a TCP session.
 %setup -q
 %patch2
 %patch4
+%patch5 -p1
 
 sed -i 's/^Icon=wireshark.png$/Icon=wireshark/' wireshark.desktop
 # run as root on 11.3 and older - bnc#349782
@@ -107,6 +112,10 @@ sed -i 's!^Exec=wireshark!Exec=/usr/bin/xdg-su -c /usr/bin/wireshark!' wireshark
 %endif
 
 %build
+# Needed for patch5
+autoreconf -fiv
+export SUID_CFLAGS="-fPIE"
+export SUID_LDFLAGS="-pie"
 %configure --without-zlib
 make %{?_smp_mflags}