diff --git a/ChangeLog b/ChangeLog
index 679ce1e..7af6983 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -37,6 +37,12 @@ Changes in version 1.12.6
   * Makefile - Davide Madrisan:
     Make 'make dist' a bit more verbose.
 
++ bugfix
+  * plugins/pck-update.in - Davide Madrisan:
+    infofile.create(): quote all the elements of SPEC_SOURCE to avoid problems
+    when the URL contains the letter '&'.
+    (Problem pointed out by Silvan Calarco.)
+
 -------------------------------------------------------------------------------
 
 Changes in version 1.12.5
diff --git a/plugins/pck-update.in b/plugins/pck-update.in
index 2ddeadb..dc59b02 100644
--- a/plugins/pck-update.in
+++ b/plugins/pck-update.in
@@ -536,7 +536,10 @@ done))
 SPEC_FILENAME=\"$SPEC_FILENAME\"
 SPEC_URL=\"$SPEC_URL\"
 SPEC_PATCH=(${SPEC_PATCH[*]})
-SPEC_SOURCE=(${SPEC_SOURCE[*]})
+SPEC_SOURCE=(\
+$(for i in `seq 1 1 ${#SPEC_SOURCE[*]}`; do
+   echo -n "\"${SPEC_SOURCE[i-1]}\" "
+done))
 SPEC_LICENSE=(\
 $(for i in `seq 1 1 ${#SPEC_LICENSE[*]}`; do
    echo -n "\"${SPEC_LICENSE[i-1]}\" "