diff -u bind9-9.4.2.dfsg.P2/debian/changelog bind9-9.4.2.dfsg.P2/debian/changelog
--- bind9-9.4.2.dfsg.P2/debian/changelog
+++ bind9-9.4.2.dfsg.P2/debian/changelog
@@ -1,13 +1,14 @@
-bind9 (1:9.4.2.dfsg.P2-2ubuntu0.3) hardy-security; urgency=low
+bind9 (1:9.4.2.dfsg.P2-2ubuntu0.4) hardy-security; urgency=low
 
   * SECURITY UPDATE: incorrect cache update from additional section
     - bin/named/query.c, lib/dns/{include/dns/types.h,masterdump.c,
       rbtdb.c,resolver.c,validator.c}: handle the additional section
       properly. lib/dns/api, version: increment versions.
-    - debian/*: increment to libdns36
+    - debian/*: increment to libdns36, add libdns35 metapackage so
+      upgrade-manager won't hold the bind9 upgrade back.
     - CVE-2009-4022
 
- -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 30 Nov 2009 15:18:14 -0500
+ -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 04 Dec 2009 09:13:41 -0500
 
 bind9 (1:9.4.2.dfsg.P2-2ubuntu0.2) hardy-security; urgency=low
 
diff -u bind9-9.4.2.dfsg.P2/debian/control bind9-9.4.2.dfsg.P2/debian/control
--- bind9-9.4.2.dfsg.P2/debian/control
+++ bind9-9.4.2.dfsg.P2/debian/control
@@ -45,7 +45,7 @@
 Architecture: any
 Conflicts: bind-dev
 Replaces: bind-dev
-Depends: libdns36 (= ${binary:Version}), libisc35 (= ${binary:Version}), libisccc30(= ${binary:Version}), libisccfg30 (= ${binary:Version}), liblwres30 (= ${binary:Version}) 
+Depends: libdns36, libisc35, libisccc30, libisccfg30, liblwres30
 Description: Static Libraries and Headers used by BIND
  This package delivers archive-style libraries, header files, and API man
  pages for libbind, libdns, libisc, and liblwres.  These are are only needed 
@@ -65,13 +65,23 @@
  This package delivers the libbind9 shared library used by BIND's daemons and
  clients.
 
+Package: libdns35
+Section: libs
+Priority: standard
+Architecture: any
+Conflicts: libisc35 (<< ${binary:Version})
+Description: DNS Shared Library used by BIND
+ ${Description}
+ .
+ This metapackage eases the upgrade path to libdns36.
+
 Package: libdns36
 Section: libs
 Priority: standard
 Architecture: any
 Conflicts: libbind0
 Replaces: libbind0
-Depends: ${shlibs:Depends}, libisc35 (= ${binary:Version})
+Depends: ${shlibs:Depends}, libisc35
 Description: DNS Shared Library used by BIND
  ${Description}
  .