diff --git a/qemu-parallels-image-format-overflow.patch b/qemu-parallels-image-format-overflow.patch
new file mode 100644
index 0000000..dc3283a
--- /dev/null
+++ b/qemu-parallels-image-format-overflow.patch
@@ -0,0 +1,41 @@
+From ff1a1e986f2e167c2538160d0476ac61cda31f77 Mon Sep 17 00:00:00 2001
+From: David Woodhouse <dwmw2@infradead.org>
+Date: Sat, 7 Nov 2009 14:10:01 +0000
+Subject: [PATCH] Fix 32-bit overflow in parallels image support
+
+(cherry picked from commit c34d2451ed32651e14e309f94009be07d231ee96)
+
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
+Signed-off-by: Mark McLoughlin <markmc@redhat.com>
+Fedora-patch: qemu-parallels-image-format-overflow.patch
+---
+ block/parallels.c | 5 +++--
+ 1 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/block/parallels.c b/block/parallels.c
+index 0b64a5c..63b6738 100644
+--- a/block/parallels.c
++++ b/block/parallels.c
+@@ -119,7 +119,8 @@ fail:
+ static inline int seek_to_sector(BlockDriverState *bs, int64_t sector_num)
+ {
+ BDRVParallelsState *s = bs->opaque;
+- uint32_t index, offset, position;
++ uint32_t index, offset;
++ uint64_t position;
+
+ index = sector_num / s->tracks;
+ offset = sector_num % s->tracks;
+@@ -128,7 +129,7 @@ static inline int seek_to_sector(BlockDriverState *bs, int64_t sector_num)
+ if ((index > s->catalog_size) || (s->catalog_bitmap[index] == 0))
+ return -1;
+
+- position = (s->catalog_bitmap[index] + offset) * 512;
++ position = (uint64_t)(s->catalog_bitmap[index] + offset) * 512;
+
+ // fprintf(stderr, "sector: %llx index=%x offset=%x pointer=%x position=%x\n",
+ // sector_num, index, offset, s->catalog_bitmap[index], position);
+--
+1.6.2.5
+
diff --git a/qemu-slirp-use-after-free.patch b/qemu-slirp-use-after-free.patch
new file mode 100644
index 0000000..4e1d527
--- /dev/null
+++ b/qemu-slirp-use-after-free.patch
@@ -0,0 +1,31 @@
+From 56d370091cb01878c580f528011cd1717f8077fa Mon Sep 17 00:00:00 2001
+From: Mark McLoughlin <markmc@redhat.com>
+Date: Fri, 20 Nov 2009 18:07:15 +0000
+Subject: [PATCH] slirp: fix use-after-free
+
+460fec67ee introduced a use-after free in slirp.
+
+Cc: Jan Kiszka <jan.kiszka@siemens.com>
+Signed-off-by: Mark McLoughlin <markmc@redhat.com>
+Fedora-patch: qemu-slirp-use-after-free.patch
+---
+ slirp/mbuf.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/slirp/mbuf.c b/slirp/mbuf.c
+index 7652fea..87508ba 100644
+--- a/slirp/mbuf.c
++++ b/slirp/mbuf.c
+@@ -95,8 +95,8 @@ m_free(struct mbuf *m)
+ * Either free() it or put it on the free list
+ */
+ if (m->m_flags & M_DOFREE) {
+- free(m);
+ m->slirp->mbuf_alloced--;
++ free(m);
+ } else if ((m->m_flags & M_FREELIST) == 0) {
+ insque(m,&m->slirp->m_freelist);
+ m->m_flags = M_FREELIST; /* Clobber other flags */
+--
+1.6.2.5
+
diff --git a/qemu.spec b/qemu.spec
index 6878fc5..c9cd57f 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -1,7 +1,7 @@
Summary: QEMU is a FAST! processor emulator
Name: qemu
Version: 0.11.0
-Release: 11%{?dist}
+Release: 12%{?dist}
# Epoch because we pushed a qemu-1.0 package
Epoch: 2
License: GPLv2+ and LGPLv2+ and BSD
@@ -61,6 +61,12 @@ Patch12: qemu-fix-dropped-packets-with-non-virtio-nics.patch
# Temporarily disable preadv/pwritev support (#526549)
Patch13: qemu-disable-preadv-support.patch
+# Fix a use-after-free crasher in the slirp code (#539583)
+Patch14: qemu-slirp-use-after-free.patch
+
+# Fix overflow in the parallels image format support (#533573)
+Patch15: qemu-parallels-image-format-overflow.patch
+
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildRequires: SDL-devel zlib-devel which texi2html gnutls-devel cyrus-sasl-devel
BuildRequires: rsync dev86 iasl
@@ -261,6 +267,8 @@ such as kvmtrace and kvm_stat.
%patch11 -p1
%patch12 -p1
%patch13 -p1
+%patch14 -p1
+%patch15 -p1
%build
# --build-id option is used fedora 8 onwards for giving info to the debug packages.
@@ -542,6 +550,10 @@ fi
%{_mandir}/man1/qemu-img.1*
%changelog
+* Fri Nov 20 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-12
+- Fix a use-after-free crasher in the slirp code (#539583)
+- Fix overflow in the parallels image format support (#533573)
+
* Wed Nov 4 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-11
- Temporarily disable preadv/pwritev support to fix data corruption (#526549)