diff --git a/.gitignore b/.gitignore
index b972c44..d85e870 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 /game-music-emu-0.5.5.tbz2
 /game-music-emu-0.6.0.tar.bz2
 /game-music-emu-0.6.1.tar.bz2
+/game-music-emu-0.6.2.tar.xz
diff --git a/game-music-emu.spec b/game-music-emu.spec
index 341b09f..651d621 100644
--- a/game-music-emu.spec
+++ b/game-music-emu.spec
@@ -1,11 +1,11 @@
 Name:           game-music-emu
-Version:        0.6.1
-Release:        6%{?dist}
+Version:        0.6.2
+Release:        1%{?dist}
 Provides:       libgme%{?_isa} = %{version}-%{release}
 Summary:        Video game music file emulation/playback library
 License:        LGPLv2+
 URL:            https://bitbucket.org/mpyne/game-music-emu/wiki/Home
-Source0:        https://bitbucket.org/mpyne/game-music-emu/downloads/%{name}-%{version}.tar.bz2
+Source0:        https://bitbucket.org/mpyne/game-music-emu/downloads/%{name}-%{version}.tar.xz
 
 BuildRequires:  gcc
 BuildRequires:  gcc-c++
@@ -88,6 +88,11 @@ cd ..
 
 
 %changelog
+* Tue Dec 18 2018 Karel Volný <kvolny@redhat.com> 0.6.2-1
+- New release 0.6.2
+- Fixes CVE-2017-17446 (rhbz#1524562)
+- Update tarball url
+
 * Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.1-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 
diff --git a/sources b/sources
index a47e5f0..39e7955 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (game-music-emu-0.6.1.tar.bz2) = 06b3544086fae51361706b0417ae1bc3769863c7d060ebabdd09b930d37df973314c43afff32aedaa9ebb74cdeafdeadaac4aa5d448700ee961d79d7fc9012b4
+SHA512 (game-music-emu-0.6.2.tar.xz) = 1808d28b54cbbd8dc5e3240eb27d2e546398fb62ab6577e59430a7543cfdaa06482f70b4750656b73a05f1c1bc0c0254db97d0940271ea2144724e1c44f5da10