diff --git a/MozillaFirefox.changes b/MozillaFirefox.changes
index 7be2ac2..0f1d6a1 100644
--- a/MozillaFirefox.changes
+++ b/MozillaFirefox.changes
@@ -1,7 +1,23 @@
+-------------------------------------------------------------------
+Fri Dec  8 15:52:17 UTC 2017 - dimstar@opensuse.org
+
+- Explicitly buildrequires python2-xml: The build system relies on
+  it. We wrongly relied on other packages pulling it in for us.
+
+-------------------------------------------------------------------
+Thu Dec  7 11:12:31 UTC 2017 - dimstar@opensuse.org
+
+- Escape the usage of %{VERSION} when calling out to rpm.
+  RPM 4.14 has %{VERSION} defined as 'the main packages version'.
+
 -------------------------------------------------------------------
 Wed Nov 29 23:45:03 UTC 2017 - wr@rosenauer.org
 
 - update to Firefox 57.0.1
+  * CVE-2017-7843: Web worker in Private Browsing mode can write
+    IndexedDB data (bsc#1072034, bmo#1410106)
+  * CVE-2017-7844: Visited history information leak through SVG
+    image (bsc#1072036, bmo#1420001)
   * Fix a video color distortion issue on YouTube and other video
     sites with some AMD devices (bmo#1417442)
   * Fix an issue with prefs.js when the profile path has non-ascii
diff --git a/MozillaFirefox.spec b/MozillaFirefox.spec
index 037c5c7..f2a59dd 100644
--- a/MozillaFirefox.spec
+++ b/MozillaFirefox.spec
@@ -75,6 +75,7 @@ BuildRequires:  makeinfo
 BuildRequires:  mozilla-nspr-devel >= 4.17
 BuildRequires:  mozilla-nss-devel >= 3.33
 BuildRequires:  python-devel
+BuildRequires:  python2-xml
 BuildRequires:  rust >= 1.19
 BuildRequires:  rust-std
 BuildRequires:  startup-notification-devel
@@ -166,8 +167,8 @@ Requires(postun): shared-mime-info desktop-file-utils
 %if %branding
 Requires:       %{name}-branding > 44.0
 %endif
-Requires:       mozilla-nspr >= %(rpm -q --queryformat '%{VERSION}' mozilla-nspr)
-Requires:       mozilla-nss >= %(rpm -q --queryformat '%{VERSION}' mozilla-nss)
+Requires:       mozilla-nspr >= %(rpm -q --queryformat '%%{VERSION}' mozilla-nspr)
+Requires:       mozilla-nss >= %(rpm -q --queryformat '%%{VERSION}' mozilla-nss)
 Recommends:     libcanberra0
 Recommends:     libpulse0
 # addon leads to startup crash (bnc#908892)