diff --git a/0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch b/0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
new file mode 100644
index 0000000..4905493
--- /dev/null
+++ b/0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
@@ -0,0 +1,11 @@
+diff -rupN krb5-1.14/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c krb5-1.14-patched/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+--- krb5-1.14/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c	2016-03-23 14:00:44.669126353 +0100
++++ krb5-1.14-patched/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c	2016-03-23 14:01:45.993680720 +0100
+@@ -267,6 +267,7 @@ process_db_args(krb5_context context, ch
+     if (db_args) {
+         for (i=0; db_args[i]; ++i) {
+             arg = strtok_r(db_args[i], "=", &arg_val);
++            arg = (arg != NULL) ? arg : "";
+             if (strcmp(arg, TKTPOLICY_ARG) == 0) {
+                 dptr = &xargs->tktpolicydn;
+             } else {
diff --git a/krb5.changes b/krb5.changes
index 5bbbf23..22b01b2 100644
--- a/krb5.changes
+++ b/krb5.changes
@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Wed Mar 23 13:02:48 UTC 2016 - hguo@suse.com
+
+- Introduce patch
+  0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
+  to fix CVE-2016-3119 (bsc#971942)
+
 -------------------------------------------------------------------
 Thu Feb 11 15:06:31 UTC 2016 - hguo@suse.com
 
diff --git a/krb5.spec b/krb5.spec
index ddb0217..d606767 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -75,6 +75,7 @@ Patch16:        krb5-mechglue_inqure_attrs.patch
 Patch104:       0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
 Patch105:       0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
 Patch106:       0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
+Patch107:       0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 PreReq:         mktemp, grep, /bin/touch, coreutils
 PreReq:         %fillup_prereq 
@@ -188,6 +189,7 @@ Include Files for Development
 %patch104 -p1
 %patch105 -p1
 %patch106 -p1
+%patch107 -p1
 
 %build
 # needs to be re-generated