diff --git a/0017-bsc#1088619-add-version.patch b/0017-bsc#1088619-add-version.patch
new file mode 100644
index 0000000..8d6543f
--- /dev/null
+++ b/0017-bsc#1088619-add-version.patch
@@ -0,0 +1,4 @@
+--- /dev/null 2018-04-10 08:30:37.121221591 +0800
++++ corosync-2.4.3/.tarball-version 2018-04-10 18:30:37.907779088 +0800
+@@ -0,0 +1 @@
++2.4.3
diff --git a/0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch b/0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
new file mode 100644
index 0000000..062725e
--- /dev/null
+++ b/0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
@@ -0,0 +1,26 @@
+--- corosync-2.4.3.orig/exec/totemcrypto.c	2017-10-20 20:40:19.000000000 +0800
++++ corosync-2.4.3/exec/totemcrypto.c	2018-04-13 13:01:02.864922963 +0800
+@@ -736,6 +736,11 @@
+ 		unsigned char	tmp_hash[hash_len[instance->crypto_hash_type]];
+ 		int             datalen = *buf_len - hash_len[instance->crypto_hash_type];
+ 
++		if (*buf_len <= hash_len[instance->crypto_hash_type]) {
++			log_printf(instance->log_level_security, "Received message is too short...  ignoring");
++			return -1;
++		}
++        
+ 		if (calculate_nss_hash(instance, buf, datalen, tmp_hash) < 0) {
+ 			return -1;
+ 		}
+@@ -845,6 +850,11 @@
+ {
+ 	struct crypto_config_header *cch = (struct crypto_config_header *)buf;
+ 
++	if (*buf_len <= sizeof(struct crypto_config_header)) {
++		log_printf(instance->log_level_security, "Received message is too short...  ignoring");
++		return (-1);
++	}
++    
+ 	if (cch->crypto_cipher_type != CRYPTO_CIPHER_TYPE_2_3) {
+ 		log_printf(instance->log_level_security,
+ 			   "Incoming packet has different crypto type. Rejecting");
diff --git a/corosync.changes b/corosync.changes
index 466e018..0c7cbf4 100644
--- a/corosync.changes
+++ b/corosync.changes
@@ -1,3 +1,15 @@
+-------------------------------------------------------------------
+Fri Apr 13 05:17:10 UTC 2018 - bliu@suse.com
+
+-  (CVE-2018-1084) VUL-0: CVE-2018-1084: corosync: Integer overflow in totemcrypto(bsc#1089346)
+    Added: 0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
+    
+-------------------------------------------------------------------
+Tue Apr 10 02:46:08 UTC 2018 - bliu@suse.com
+
+- UNKNOWN version in corosync pkg-config(bsc#1088619)
+    Added: 0017-bsc#1088619-add-version.patch
+
 -------------------------------------------------------------------
 Thu Mar  8 06:19:09 UTC 2018 - bliu@suse.com
 
diff --git a/corosync.spec b/corosync.spec
index fb1ce6a..49f0fb2 100644
--- a/corosync.spec
+++ b/corosync.spec
@@ -78,6 +78,8 @@ Patch20:        0013-logging-Make-blackbox-configurable.patch
 Patch21:        0014-logging-Close-before-and-open-blackbox-after-fork.patch
 Patch22:        0015-coverity-fixes.patch
 Patch23:        0016-bsc#1083561-upgrade-from-1-x-y.patch
+Patch24:        0017-bsc#1088619-add-version.patch
+Patch25:        0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
 
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 # openais is indeed gone and should be uninstalled. Yes, we do not
@@ -166,6 +168,8 @@ BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 %patch21 -p1
 %patch22 -p1
 %patch23 -p1
+%patch24 -p1
+%patch25 -p1
 
 %build
 %if %{with runautogen}