diff --git a/libquicktime-1.2.4-integer_overflow.patch b/libquicktime-1.2.4-integer_overflow.patch
new file mode 100644
index 0000000..c5efc78
--- /dev/null
+++ b/libquicktime-1.2.4-integer_overflow.patch
@@ -0,0 +1,13 @@
+Index: libquicktime-1.2.4/src/util.c
+===================================================================
+--- libquicktime-1.2.4.orig/src/util.c
++++ libquicktime-1.2.4/src/util.c
+@@ -340,7 +340,7 @@ int64_t quicktime_byte_position(quicktim
+ 
+ void quicktime_read_pascal(quicktime_t *file, char *data)
+ {
+-	char len = quicktime_read_char(file);
++	unsigned char len = quicktime_read_char(file);
+ 	quicktime_read_data(file, (uint8_t*)data, len);
+ 	data[(int)len] = 0;
+ }
diff --git a/libquicktime.changes b/libquicktime.changes
index 99b53cc..7f9d182 100644
--- a/libquicktime.changes
+++ b/libquicktime.changes
@@ -1,3 +1,12 @@
+-------------------------------------------------------------------
+Tue Feb 14 11:11:34 UTC 2017 - kstreitova@suse.com
+
+- add libquicktime-1.2.4-integer_overflow.patch to fix integer
+  overflow in the quicktime_read_pascal function in libquicktime
+  1.2.4 and earlier that allows remote attackers to cause a denial
+  of service or possibly have other unspecified impact via a crafted
+  hdlr MP4 atom [bsc#1022805] CVE-2016-2399 
+
 -------------------------------------------------------------------
 Mon Jul 25 12:44:39 UTC 2016 - olaf@aepfle.de
 
diff --git a/libquicktime.spec b/libquicktime.spec
index 7e8599a..c1b5363 100644
--- a/libquicktime.spec
+++ b/libquicktime.spec
@@ -1,7 +1,7 @@
 #
 # spec file for package libquicktime
 #
-# Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -37,6 +37,8 @@ Source1:        COPYING
 Source2:        baselibs.conf
 Patch0:         libquicktime-ffmpeg3.patch
 Patch1:         libquicktime-faad2.patch
+# PATCH-FIX-UPSTREAM bsc#1022805 CVE-2016-2399 kstreitova@suse.com -- fix integer overflow in the quicktime_read_pascal function
+Patch2:         libquicktime-1.2.4-integer_overflow.patch
 BuildRequires:  alsa-devel
 BuildRequires:  autoconf
 BuildRequires:  automake
@@ -108,6 +110,7 @@ Tools for reading/writing quicktime movie files.
 %setup -q -n %{name}
 %patch0 -p1
 %patch1 -p1
+%patch2 -p1
 
 sed -i 's/-DGTK_DISABLE_DEPRECATED//g' configure.ac