diff --git a/sblim-cmpi-base-1.6.4-fix-possible-null-dereference.patch b/sblim-cmpi-base-1.6.4-fix-possible-null-dereference.patch
new file mode 100644
index 0000000..3555195
--- /dev/null
+++ b/sblim-cmpi-base-1.6.4-fix-possible-null-dereference.patch
@@ -0,0 +1,63 @@
+diff -up sblim-cmpi-base-1.6.4/OSBase_OperatingSystem.c.orig sblim-cmpi-base-1.6.4/OSBase_OperatingSystem.c
+--- sblim-cmpi-base-1.6.4/OSBase_OperatingSystem.c.orig	2020-02-04 13:55:31.565801631 +0100
++++ sblim-cmpi-base-1.6.4/OSBase_OperatingSystem.c	2020-02-04 13:58:39.514189758 +0100
+@@ -88,13 +88,21 @@ int get_operatingsystem_data( struct cim
+     bytes_read = fread(buf, 1, sizeof(buf)-1, fhd);
+     buf[bytes_read] = 0; /* safeguard end of buffer */
+     ptr = strstr(buf,"MemTotal");
+-    sscanf(ptr, "%*s %lld", &((*sptr)->totalPhysMem));
++    if( ptr != NULL ) {
++      sscanf(ptr, "%*s %lld", &((*sptr)->totalPhysMem));
++    }
+     ptr = strstr(buf,"MemFree");
+-    sscanf(ptr, "%*s %lld", &((*sptr)->freePhysMem));
++    if( ptr != NULL ) {
++      sscanf(ptr, "%*s %lld", &((*sptr)->freePhysMem));
++    }
+     ptr = strstr(buf,"SwapTotal");
+-    sscanf(ptr, "%*s %lld", &((*sptr)->totalSwapMem));
++    if( ptr != NULL ) {
++      sscanf(ptr, "%*s %lld", &((*sptr)->totalSwapMem));
++    }
+     ptr = strstr(buf,"SwapFree");
+-    sscanf(ptr, "%*s %lld", &((*sptr)->freeSwapMem));
++    if( ptr != NULL ) {
++      sscanf(ptr, "%*s %lld", &((*sptr)->freeSwapMem));
++    }
+     fclose(fhd);
+   }
+   /* TotalVirtualMemorySize */
+diff -up sblim-cmpi-base-1.6.4/OSBase_OperatingSystemStatisticalData.c.orig sblim-cmpi-base-1.6.4/OSBase_OperatingSystemStatisticalData.c
+--- sblim-cmpi-base-1.6.4/OSBase_OperatingSystemStatisticalData.c.orig	2020-02-04 13:55:31.557801615 +0100
++++ sblim-cmpi-base-1.6.4/OSBase_OperatingSystemStatisticalData.c	2020-02-04 14:09:01.613474453 +0100
+@@ -109,13 +109,15 @@ int get_queue_info_24(struct os_statisti
+     if ((f = fopen("/proc/loadavg","r")) != NULL) {
+         fgets(buf,127,f);
+         strptr = strstr(buf,"/");
+-        *strptr = '\0';
+-        while (*strptr != ' ') {
+-            strptr--;
++        if (strptr != NULL) {
++          *strptr = '\0';
++          while (*strptr != ' ') {
++              strptr--;
++          }
++          stats->run_queue_length = atoll(strptr);
++          res = 1;
+         }
+-        stats->run_queue_length = atoll(strptr);
+         fclose(f);
+-        res = 1;
+     } else {
+         _OSBASE_TRACE(1,("get_queue_info: could not open /proc/loadavg: %s",strerror(errno)));
+     }
+@@ -173,7 +175,8 @@ int get_cpu_page_data_24(struct os_stati
+              *
+              * page <in> <out>
+             */
+-            if (sscanf(strptr,"page %lld %lld",&pages_in, &pages_out) == 2) {
++            if (strptr != NULL &&
++                sscanf(strptr,"page %lld %lld",&pages_in, &pages_out) == 2) {
+                 stats->pages_in = pages_in;
+                 stats->pages_out = pages_out;
+                 res = 1;
diff --git a/sblim-cmpi-base.spec b/sblim-cmpi-base.spec
index c570552..7356334 100644
--- a/sblim-cmpi-base.spec
+++ b/sblim-cmpi-base.spec
@@ -1,6 +1,6 @@
 Name:           sblim-cmpi-base
 Version:        1.6.4
-Release:        15%{?dist}
+Release:        16%{?dist}
 Summary:        SBLIM CMPI Base Providers
 
 License:        EPL-1.0
@@ -22,6 +22,8 @@ Patch7:         sblim-cmpi-base-1.6.4-dont-install-license.patch
 # Patch8: fixes getting of InstallDate property, improves it to work
 #   on non en_US locales and updates support for Fedora
 Patch8:         sblim-cmpi-base-1.6.4-fix-get-os-install-date.patch
+# Patch9: fixes possible null pointer dereferences after strstr calls
+Patch9:         sblim-cmpi-base-1.6.4-fix-possible-null-dereference.patch
 Requires:       cim-server sblim-indication_helper
 BuildRequires:  perl-generators
 BuildRequires:  sblim-cmpi-devel sblim-indication_helper-devel
@@ -64,6 +66,7 @@ autoreconf --install --force
 %patch6 -p1 -b .list-lib-dependencies
 %patch7 -p1 -b .dont-install-license
 %patch8 -p1 -b .fix-get-os-install-date
+%patch9 -p1 -b .fix-possible-null-dereference.patch
 
 %build
 %configure TESTSUITEDIR=%{_datadir}/sblim-testsuite --disable-static
@@ -116,6 +119,9 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/cmpi/*a
 %postun -p /sbin/ldconfig
 
 %changelog
+* Tue Feb 04 2020 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.6.4-16
+- Fix possible null pointer dereferences after strstr calls
+
 * Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.4-15
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild