diff --git a/SOURCES/CVE-2017-14746.patch b/SOURCES/CVE-2017-14746.patch
new file mode 100644
index 0000000..d33d24d
--- /dev/null
+++ b/SOURCES/CVE-2017-14746.patch
@@ -0,0 +1,63 @@
+From 5b2d738fb3e5d40590261702a8e7564a5b0e46d5 Mon Sep 17 00:00:00 2001
+From: Jeremy Allison <jra@samba.org>
+Date: Tue, 19 Sep 2017 16:11:33 -0700
+Subject: [PATCH] s3: smbd: Fix SMB1 use-after-free crash bug. CVE-2017-14746
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When setting up the chain, always use 'next->' variables
+not the 'req->' one.
+
+Bug discovered by 连一汉 <lianyihan@360.cn>
+
+CVE-2017-14746
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=13041
+
+Signed-off-by: Jeremy Allison <jra@samba.org>
+---
+ source3/smbd/process.c | 7 ++++---
+ source3/smbd/reply.c   | 5 +++++
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/source3/smbd/process.c b/source3/smbd/process.c
+index b65ae2c1b1c..9b2b0a669a2 100644
+--- a/source3/smbd/process.c
++++ b/source3/smbd/process.c
+@@ -1855,12 +1855,13 @@ void smb_request_done(struct smb_request *req)
+ 
+ 		next->vuid = SVAL(req->outbuf, smb_uid);
+ 		next->tid  = SVAL(req->outbuf, smb_tid);
+-		status = smb1srv_tcon_lookup(req->xconn, req->tid,
++		status = smb1srv_tcon_lookup(req->xconn, next->tid,
+ 					     now, &tcon);
++
+ 		if (NT_STATUS_IS_OK(status)) {
+-			req->conn = tcon->compat;
++			next->conn = tcon->compat;
+ 		} else {
+-			req->conn = NULL;
++			next->conn = NULL;
+ 		}
+ 		next->chain_fsp = req->chain_fsp;
+ 		next->inbuf = req->inbuf;
+diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
+index 7b07078249b..81acedf0413 100644
+--- a/source3/smbd/reply.c
++++ b/source3/smbd/reply.c
+@@ -923,6 +923,11 @@ void reply_tcon_and_X(struct smb_request *req)
+ 		}
+ 
+ 		TALLOC_FREE(tcon);
++		/*
++		 * This tree id is gone. Make sure we can't re-use it
++		 * by accident.
++		 */
++		req->tid = 0;
+ 	}
+ 
+ 	if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
+-- 
+2.14.2.920.gcf0c67979c-goog
+
diff --git a/SOURCES/CVE-2017-15275.patch b/SOURCES/CVE-2017-15275.patch
new file mode 100644
index 0000000..f0510f9
--- /dev/null
+++ b/SOURCES/CVE-2017-15275.patch
@@ -0,0 +1,45 @@
+From 6dd87a82a733184df3a6f09e020f6a3c2b365ca2 Mon Sep 17 00:00:00 2001
+From: Jeremy Allison <jra@samba.org>
+Date: Wed, 20 Sep 2017 11:04:50 -0700
+Subject: [PATCH] s3: smbd: Chain code can return uninitialized memory when
+ talloc buffer is grown.
+
+Ensure we zero out unused grown area.
+
+CVE-2017-15275
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=13077
+
+Signed-off-by: Jeremy Allison <jra@samba.org>
+---
+ source3/smbd/srvstr.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/source3/smbd/srvstr.c b/source3/smbd/srvstr.c
+index 56dceba8c6c..c2d70b32c32 100644
+--- a/source3/smbd/srvstr.c
++++ b/source3/smbd/srvstr.c
+@@ -110,6 +110,20 @@ ssize_t message_push_string(uint8_t **outbuf, const char *str, int flags)
+ 		DEBUG(0, ("srvstr_push failed\n"));
+ 		return -1;
+ 	}
++
++	/*
++	 * Ensure we clear out the extra data we have
++	 * grown the buffer by, but not written to.
++	 */
++	if (buf_size + result < buf_size) {
++		return -1;
++	}
++	if (grow_size < result) {
++		return -1;
++	}
++
++	memset(tmp + buf_size + result, '\0', grow_size - result);
++
+ 	set_message_bcc((char *)tmp, smb_buflen(tmp) + result);
+ 
+ 	*outbuf = tmp;
+-- 
+2.14.2.920.gcf0c67979c-goog
+
diff --git a/SPECS/samba.spec b/SPECS/samba.spec
index 8ad30d5..538d62f 100644
--- a/SPECS/samba.spec
+++ b/SPECS/samba.spec
@@ -6,7 +6,7 @@
 # ctdb is enabled by default, you can disable it with: --without clustering
 %bcond_without clustering
 
-%define main_release 11
+%define main_release 12
 
 %define samba_version 4.6.2
 %define talloc_version 2.1.9
@@ -131,6 +131,8 @@ Patch18: samba-v4.6-graceful_fsctl_validate_negotiate_info.patch
 Patch19: CVE-2017-12150.patch
 Patch20: CVE-2017-12151.patch
 Patch21: CVE-2017-12163.patch
+Patch22: CVE-2017-14746.patch
+Patch23: CVE-2017-15275.patch
 
 Requires(pre): /usr/sbin/groupadd
 Requires(post): systemd
@@ -2652,6 +2654,9 @@ rm -rf %{buildroot}
 %endif # with_clustering_support
 
 %changelog
+* Fri Nov 17 2017 Andreas Schneider <asn@redhat.com> - 4.6.2-12
+- resolves: #1514314 - Fix CVE-2017-14746 and CVE-2017-15275
+
 * Thu Sep 14 2017 Andreas Schneider <asn@redhat.com> - 4.6.2-11
 - resolves: #1491213 - CVE-2017-12150 CVE-2017-12151 CVE-2017-12163