diff --git a/pkgs/misc/emulators/dosbox/default.nix b/pkgs/misc/emulators/dosbox/default.nix
index 878e98fa1665..61a6b4317c79 100644
--- a/pkgs/misc/emulators/dosbox/default.nix
+++ b/pkgs/misc/emulators/dosbox/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, makeDesktopItem, SDL, SDL_net, SDL_sound, libGLU_combined, libpng }:
+{ stdenv, lib, fetchurl, makeDesktopItem, SDL, SDL_net, SDL_sound, libGLU_combined, libpng, fetchpatch }:
 
 stdenv.mkDerivation rec {
   name = "dosbox-0.74-2";
@@ -8,6 +8,20 @@ stdenv.mkDerivation rec {
     sha256 = "1ksp1b5szi0vy4x55rm3j1y9wq5mlslpy8llpg87rpdyjlsk0xvh";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "cve-2019-7165.patch";
+      url = "https://salsa.debian.org/debian/dosbox/raw/30989a35ee478f8f4bc8e167fccbf92fc77e1519/debian/patches/cve-2019-7165.patch?inline=false";
+      sha256 = "12c2wq6l62x9iggg1hvs82xbdm5g5hirixvbzjpnjmkm8c4h4k38";
+    })
+    (fetchpatch {
+      name = "cve-2019-12594.patch";
+      url = "https://salsa.debian.org/debian/dosbox/raw/30989a35ee478f8f4bc8e167fccbf92fc77e1519/debian/patches/cve-2019-12594.patch?inline=false";
+      excludes = ["configure.in"];
+      sha256 = "1zrv2vnb86gdq9z4irqflzf7lz3r6rc6m46k1hdb8ldl1c88w8jj";
+    })
+  ];
+
   hardeningDisable = [ "format" ];
 
   buildInputs = [ SDL SDL_net SDL_sound libGLU_combined libpng ];