--- lib/bglv.c.orig	2008-12-18 13:13:50.000000000 +0100
+++ lib/bglv.c	2008-12-18 13:14:58.000000000 +0100
@@ -70,7 +70,7 @@
   {
   char * domain;
   domain = bg_sprintf("lv.%s", funcname);
-  bg_log_notranslate(BG_LOG_ERROR, domain, message);
+  bg_log_notranslate(BG_LOG_ERROR, domain, "%s", message);
   free(domain);
   }
 
@@ -79,7 +79,7 @@
   {
   char * domain;
   domain = bg_sprintf("lv.%s", funcname);
-  bg_log_notranslate(BG_LOG_INFO, domain, message);
+  bg_log_notranslate(BG_LOG_INFO, domain, "%s", message);
   free(domain);
   }
 
@@ -88,7 +88,7 @@
   {
   char * domain;
   domain = bg_sprintf("lv.%s", funcname);
-  bg_log_notranslate(BG_LOG_WARNING, domain, message);
+  bg_log_notranslate(BG_LOG_WARNING, domain, "%s", message);
   free(domain);
   }
 
--- lib/cmdline.c.orig	2008-12-18 13:15:26.000000000 +0100
+++ lib/cmdline.c	2008-12-18 13:21:12.000000000 +0100
@@ -156,7 +156,7 @@
       }
       break;
     default:
-      fprintf(out, str);
+      fprintf(out, "%s", str);
       break;
     }
   }
@@ -724,12 +724,12 @@
       
       if(parameters[i].opt)
         {
-        fprintf(out, parameters[i].opt);
+        fprintf(out, "%s", parameters[i].opt);
         pos += strlen(parameters[i].opt);
         }
       else
         {
-        fprintf(out, parameters[i].name);
+        fprintf(out, "%s", parameters[i].name);
         pos += strlen(parameters[i].name);
         }
       fprintf(out, " \"=");
@@ -871,7 +871,7 @@
             pos += indent+2;
             }
           
-          pos += fprintf(out, parameters[i].multi_names[j]);
+          pos += fprintf(out, "%s", parameters[i].multi_names[j]);
           j++;
           }
         print_linebreak(out, format);
@@ -945,7 +945,7 @@
             do_indent(out, indent+2, format);
             pos += indent+2;
             }
-          pos += fprintf(out, parameters[i].multi_names[j]);
+          pos += fprintf(out, "%s", parameters[i].multi_names[j]);
           j++;
           }
 
@@ -984,7 +984,7 @@
             do_indent(out, indent+4, format);
             pos += indent+4;
             }
-          pos += fprintf(out, parameters[i].multi_names[j]);
+          pos += fprintf(out, "%s", parameters[i].multi_names[j]);
           j++;
           }
         fprintf(out, "\n\n");
--- lib/visualize.c.orig	2008-12-18 13:22:26.000000000 +0100
+++ lib/visualize.c	2008-12-18 13:22:59.000000000 +0100
@@ -518,7 +518,7 @@
     case BG_LOG_DEBUG:
       domain = bg_msg_get_arg_string(v->msg, 0);
       msg    = bg_msg_get_arg_string(v->msg, 1);
-      bg_log_notranslate(id, domain, msg);
+      bg_log_notranslate(id, domain, "%s", msg);
       free(domain);
       free(msg);
       break;
--- plugins/postprocessors/cdrdao_common.c.orig	2008-12-18 13:25:21.000000000 +0100
+++ plugins/postprocessors/cdrdao_common.c	2008-12-18 13:27:03.000000000 +0100
@@ -178,12 +178,12 @@
 
     if(!strncmp(line, "ERROR", 5))
       {
-      bg_log(BG_LOG_ERROR, LOG_DOMAIN, line);	   
+      bg_log(BG_LOG_ERROR, LOG_DOMAIN, "%s", line);	   
       //      break;
       }
     else if(!strncmp(line, "WARNING", 7))
       {
-      bg_log(BG_LOG_WARNING, LOG_DOMAIN, line);	   
+      bg_log(BG_LOG_WARNING, LOG_DOMAIN, "%s", line);	   
       //      break;
       }
     else if(!strncmp(line, "Writing", 7))
@@ -191,7 +191,7 @@
       if(c->callbacks && c->callbacks->action_callback)
         c->callbacks->action_callback(c->callbacks->data,
                                       line);
-      bg_log(BG_LOG_INFO, LOG_DOMAIN, line);
+      bg_log(BG_LOG_INFO, LOG_DOMAIN, "%s", line);
 
       if(c->callbacks && c->callbacks->progress_callback)
         {
@@ -206,10 +206,10 @@
         c->callbacks->progress_callback(c->callbacks->data,
                                         (float)mb_written/(float)mb_total);
       else
-        bg_log(BG_LOG_INFO, LOG_DOMAIN, line);
+        bg_log(BG_LOG_INFO, LOG_DOMAIN, "%s", line);
       }
     else
-      bg_log(BG_LOG_INFO, LOG_DOMAIN, line);
+      bg_log(BG_LOG_INFO, LOG_DOMAIN, "%s", line);
     }
   bg_subprocess_close(cdrdao);
 
--- plugins/postprocessors/e_pp_vcdimager.c.orig	2008-12-18 13:27:20.000000000 +0100
+++ plugins/postprocessors/e_pp_vcdimager.c	2008-12-18 13:27:45.000000000 +0100
@@ -222,7 +222,7 @@
     if(!(end = strstr(start, "</log>")))
       return;
     *end = '\0';
-    bg_log(log_level, LOG_DOMAIN, start);
+    bg_log(log_level, LOG_DOMAIN, "%s", start);
     }
   else if(!strncmp(line, "<progress ", 10))
     {