diff --git a/SOURCES/glibc-rh1912544.patch b/SOURCES/glibc-rh1912544.patch
new file mode 100644
index 0000000..c64e731
--- /dev/null
+++ b/SOURCES/glibc-rh1912544.patch
@@ -0,0 +1,126 @@
+commit ee7a3144c9922808181009b7b3e50e852fb4999b
+Author: Andreas Schwab <schwab@suse.de>
+Date: Mon Dec 21 08:56:43 2020 +0530
+
+ Fix buffer overrun in EUC-KR conversion module (bz #24973)
+
+ The byte 0xfe as input to the EUC-KR conversion denotes a user-defined
+ area and is not allowed. The from_euc_kr function used to skip two bytes
+ when told to skip over the unknown designation, potentially running over
+ the buffer end.
+
+# Conflicts:
+# iconvdata/Makefile
+
+diff --git a/iconvdata/Makefile b/iconvdata/Makefile
+index 06e161d9b8f67118..a47a4c07cd2e3d1b 100644
+--- a/iconvdata/Makefile
++++ b/iconvdata/Makefile
+@@ -73,7 +73,7 @@ modules.so := $(addsuffix .so, $(modules))
+ ifeq (yes,$(build-shared))
+ tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \
+ tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \
+- bug-iconv10 bug-iconv11 bug-iconv12
++ bug-iconv10 bug-iconv11 bug-iconv12 bug-iconv13
+ ifeq ($(have-thread-library),yes)
+ tests += bug-iconv3
+ endif
+diff --git a/iconvdata/bug-iconv13.c b/iconvdata/bug-iconv13.c
+new file mode 100644
+index 0000000000000000..87aaff398e0f6167
+--- /dev/null
++++ b/iconvdata/bug-iconv13.c
+@@ -0,0 +1,53 @@
++/* bug 24973: Test EUC-KR module
++ Copyright (C) 2020 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ <https://www.gnu.org/licenses/>. */
++
++#include <errno.h>
++#include <iconv.h>
++#include <stdio.h>
++#include <support/check.h>
++
++static int
++do_test (void)
++{
++ iconv_t cd = iconv_open ("UTF-8//IGNORE", "EUC-KR");
++ TEST_VERIFY_EXIT (cd != (iconv_t) -1);
++
++ /* 0xfe (->0x7e : row 94) and 0xc9 (->0x49 : row 41) are user-defined
++ areas, which are not allowed and should be skipped over due to
++ //IGNORE. The trailing 0xfe also is an incomplete sequence, which
++ should be checked first. */
++ char input[4] = { '\xc9', '\xa1', '\0', '\xfe' };
++ char *inptr = input;
++ size_t insize = sizeof (input);
++ char output[4];
++ char *outptr = output;
++ size_t outsize = sizeof (output);
++
++ /* This used to crash due to buffer overrun. */
++ TEST_VERIFY (iconv (cd, &inptr, &insize, &outptr, &outsize) == (size_t) -1);
++ TEST_VERIFY (errno == EINVAL);
++ /* The conversion should produce one character, the converted null
++ character. */
++ TEST_VERIFY (sizeof (output) - outsize == 1);
++
++ TEST_VERIFY_EXIT (iconv_close (cd) != -1);
++
++ return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/iconvdata/euc-kr.c b/iconvdata/euc-kr.c
+index 73e02817a07e873d..dc7eaa6596f5d4d4 100644
+--- a/iconvdata/euc-kr.c
++++ b/iconvdata/euc-kr.c
+@@ -80,11 +80,7 @@ euckr_from_ucs4 (uint32_t ch, unsigned char *cp)
+ \
+ if (ch <= 0x9f) \
+ ++inptr; \
+- /* 0xfe(->0x7e : row 94) and 0xc9(->0x59 : row 41) are \
+- user-defined areas. */ \
+- else if (__builtin_expect (ch == 0xa0, 0) \
+- || __builtin_expect (ch > 0xfe, 0) \
+- || __builtin_expect (ch == 0xc9, 0)) \
++ else if (__glibc_unlikely (ch == 0xa0)) \
+ { \
+ /* This is illegal. */ \
+ STANDARD_FROM_LOOP_ERR_HANDLER (1); \
+diff --git a/iconvdata/ksc5601.h b/iconvdata/ksc5601.h
+index 5588d3a14b667b42..fa2d30677c41f46a 100644
+--- a/iconvdata/ksc5601.h
++++ b/iconvdata/ksc5601.h
+@@ -50,15 +50,15 @@ ksc5601_to_ucs4 (const unsigned char **s, size_t avail, unsigned char offset)
+ unsigned char ch2;
+ int idx;
+
++ if (avail < 2)
++ return 0;
++
+ /* row 94(0x7e) and row 41(0x49) are user-defined area in KS C 5601 */
+
+ if (ch < offset || (ch - offset) <= 0x20 || (ch - offset) >= 0x7e
+ || (ch - offset) == 0x49)
+ return __UNKNOWN_10646_CHAR;
+
+- if (avail < 2)
+- return 0;
+-
+ ch2 = (*s)[1];
+ if (ch2 < offset || (ch2 - offset) <= 0x20 || (ch2 - offset) >= 0x7f)
+ return __UNKNOWN_10646_CHAR;
diff --git a/SOURCES/glibc-rh1918115.patch b/SOURCES/glibc-rh1918115.patch
new file mode 100644
index 0000000..1556ff4
--- /dev/null
+++ b/SOURCES/glibc-rh1918115.patch
@@ -0,0 +1,23 @@
+commit 23af890b3f04e80da783ba64e6b6d94822e01d54
+Author: Ondřej Hošek <ondra.hosek@gmail.com>
+Date: Wed Aug 26 04:26:50 2020 +0200
+
+ x86-64: Fix FMA4 detection in ifunc [BZ #26534]
+
+ A typo in commit 107e6a3c2212ba7a3a4ec7cae8d82d73f7c95d0b causes the
+ FMA4 code path to be taken on systems that support FMA, even if they do
+ not support FMA4. Fix this to detect FMA4.
+
+diff --git a/sysdeps/x86_64/fpu/multiarch/ifunc-fma4.h b/sysdeps/x86_64/fpu/multiarch/ifunc-fma4.h
+index 76c677198dac5cb0..6cb70ce25209ee15 100644
+--- a/sysdeps/x86_64/fpu/multiarch/ifunc-fma4.h
++++ b/sysdeps/x86_64/fpu/multiarch/ifunc-fma4.h
+@@ -32,7 +32,7 @@ IFUNC_SELECTOR (void)
+ && CPU_FEATURE_USABLE_P (cpu_features, AVX2))
+ return OPTIMIZE (fma);
+
+- if (CPU_FEATURE_USABLE_P (cpu_features, FMA))
++ if (CPU_FEATURE_USABLE_P (cpu_features, FMA4))
+ return OPTIMIZE (fma4);
+
+ return OPTIMIZE (sse2);
diff --git a/SPECS/glibc.spec b/SPECS/glibc.spec
index 48786c5..24421a5 100644
--- a/SPECS/glibc.spec
+++ b/SPECS/glibc.spec
@@ -1,6 +1,6 @@
%define glibcsrcdir glibc-2.28
%define glibcversion 2.28
-%define glibcrelease 145%{?dist}
+%define glibcrelease 147%{?dist}
# Pre-release tarballs are pulled in from git using a command that is
# effectively:
#
@@ -677,6 +677,8 @@ Patch540: glibc-rh1882466-1.patch
Patch541: glibc-rh1882466-2.patch
Patch542: glibc-rh1882466-3.patch
Patch543: glibc-rh1817513-133.patch
+Patch544: glibc-rh1912544.patch
+Patch545: glibc-rh1918115.patch
##############################################################################
# Continued list of core "glibc" package information:
@@ -2588,6 +2590,12 @@ fi
%files -f compat-libpthread-nonshared.filelist -n compat-libpthread-nonshared
%changelog
+* Wed Jan 20 2021 Florian Weimer <fweimer@redhat.com> - 2.28-147
+- x86-64: Fix FMA4 math routine selection after bug 1817513 (#1918115)
+
+* Mon Jan 18 2021 Siddhesh Poyarekar <siddhesh@redhat.com> - 2.28-146
+- CVE-2019-25013:Fix buffer overrun in EUC-KR conversion module (#1912544)
+
* Mon Jan 4 2021 Florian Weimer <fweimer@redhat.com> - 2.28-145
- Update glibc-hwcaps fix from upstream (#1817513)