diff --git a/pkgs/development/compilers/as31/default.nix b/pkgs/development/compilers/as31/default.nix
index 4db3b1b5a8d..fa34b3afe51 100644
--- a/pkgs/development/compilers/as31/default.nix
+++ b/pkgs/development/compilers/as31/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, yacc }:
+{ stdenv, fetchpatch, fetchurl, yacc }:
 
 let
 
@@ -14,6 +14,15 @@ in stdenv.mkDerivation {
 
   buildInputs = [ yacc ];
 
+  patches = [
+    # CVE-2012-0808
+    (fetchpatch {
+       name = "as31-mkstemps.patch";
+       url = "https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=655496;filename=as31-mkstemps.patch;msg=5";
+       sha256 = "0iia4wa8m141bwz4588yxb1dp2qwhapcii382sncm6jvwyngwh21";
+     })
+  ];
+
   preConfigure = ''
     chmod +x ./configure
   '';