diff --git a/cups-str4004.patch b/cups-str4004.patch
new file mode 100644
index 0000000..f507042
--- /dev/null
+++ b/cups-str4004.patch
@@ -0,0 +1,13 @@
+diff -up cups-1.5.0/backend/snmp.c.snmp-bad-uri cups-1.5.0/backend/snmp.c
+--- cups-1.5.0/backend/snmp.c.snmp-bad-uri	2012-01-17 11:51:00.786457690 +0000
++++ cups-1.5.0/backend/snmp.c	2012-01-17 11:51:57.123384361 +0000
+@@ -1120,7 +1120,8 @@ read_snmp_response(int fd)		/* I - SNMP
+ 
+     case DEVICE_URI :
+ 	if (device && packet.object_type == CUPS_ASN1_OCTET_STRING &&
+-	    !device->uri && packet.object_value.string.num_bytes > 0)
++	    !device->uri && packet.object_value.string.num_bytes > 3 &&
++	    strlen ((char *)packet.object_value.string.bytes) > 3)
+ 	{
+ 	 /*
+ 	  * Update an existing cache entry...
diff --git a/cups-str4005.patch b/cups-str4005.patch
new file mode 100644
index 0000000..bbb488c
--- /dev/null
+++ b/cups-str4005.patch
@@ -0,0 +1,25 @@
+diff -up cups-1.5.0/cups/backend.c.backend-bad-id cups-1.5.0/cups/backend.c
+--- cups-1.5.0/cups/backend.c.backend-bad-id	2011-04-29 23:45:35.000000000 +0100
++++ cups-1.5.0/cups/backend.c	2012-01-17 12:23:13.687442534 +0000
+@@ -110,7 +110,8 @@ cupsBackendReport(
+ 
+ 
+ /*
+- * 'quote_string()' - Write a quoted string to stdout, escaping \ and ".
++ * 'quote_string()' - Write a quoted string to stdout, escaping \ and ",
++ * and replacing newline with space.
+  */
+ 
+ static void
+@@ -125,7 +126,10 @@ quote_string(const char *s)		/* I - Stri
+       if (*s == '\\' || *s == '\"')
+ 	putchar('\\');
+ 
+-      putchar(*s);
++      if (*s == '\n')
++	putchar(' ');
++      else
++	putchar(*s);
+ 
+       s ++;
+     }
diff --git a/cups.spec b/cups.spec
index 36bb09e..0c6781b 100644
--- a/cups.spec
+++ b/cups.spec
@@ -13,7 +13,7 @@
 Summary: Common Unix Printing System
 Name: cups
 Version: 1.5.0
-Release: 25%{?dist}
+Release: 26%{?dist}
 License: GPLv2
 Group: System Environment/Daemons
 Source: http://ftp.easysw.com/pub/cups/%{version}/cups-%{version}-source.tar.bz2
@@ -74,6 +74,8 @@ Patch36: cups-systemd-socket.patch
 Patch37: cups-CVE-2011-2896.patch
 Patch38: cups-str3921.patch
 Patch39: cups-ps-command-filter.patch
+Patch40: cups-str4004.patch
+Patch41: cups-str4005.patch
 
 Patch100: cups-lspp.patch
 
@@ -305,6 +307,14 @@ Sends IPP requests to the specified URI and tests and/or displays the results.
 # (STR #3973).
 %patch39 -p1 -b .ps-command-filter
 
+# Don't accept Device URIs of '\0' from SNMP devices
+# (bug #770646, STR #4004).
+%patch40 -p1 -b .str4004
+
+# Replace newline characters with spaces in reported Device IDs
+# (bug #782129, STR #4005).
+%patch41 -p1 -b .str4005
+
 %if %lspp
 # LSPP support.
 %patch100 -p1 -b .lspp
@@ -660,6 +670,12 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man1/ipptool.1.gz
 
 %changelog
+* Tue Jan 17 2012 Tim Waugh <twaugh@redhat.com> 1:1.5.0-26
+- Replace newline characters with spaces in reported Device IDs
+  (bug #782129, STR #4005).
+- Don't accept Device URIs of '\0' from SNMP devices
+  (bug #770646, STR #4004).
+
 * Fri Jan 13 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1:1.5.0-25
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild