--- js/src/xpconnect/shell/xpcshell.cpp.orig	2008-12-17 09:18:32.000000000 -0500
+++ js/src/xpconnect/shell/xpcshell.cpp	2008-12-17 09:19:05.000000000 -0500
@@ -624,7 +624,7 @@
 #endif
     {
         char line[256];
-        fprintf(gOutFile, prompt);
+        fprintf(gOutFile, "%s", prompt);
         fflush(gOutFile);
         if (!fgets(line, sizeof line, file))
             return JS_FALSE;
--- widget/src/gtk2/nsFilePicker.cpp.orig	2008-12-17 09:10:18.000000000 -0500
+++ widget/src/gtk2/nsFilePicker.cpp	2008-12-17 09:10:57.000000000 -0500
@@ -548,7 +548,8 @@
                                   GTK_DIALOG_DESTROY_WITH_PARENT,
                                   GTK_MESSAGE_QUESTION,
                                   GTK_BUTTONS_YES_NO,
-                                  NS_ConvertUTF16toUTF8(message).get());
+                                  "%s",
+				  NS_ConvertUTF16toUTF8(message).get());
   gtk_window_set_title(GTK_WINDOW(dialog), NS_ConvertUTF16toUTF8(title).get());
   if (parent_window && parent_window->group) {
     gtk_window_group_add_window(parent_window->group, GTK_WINDOW(dialog));
--- xpcom/base/nsTraceRefcntImpl.cpp.orig	2008-12-17 09:02:28.000000000 -0500
+++ xpcom/base/nsTraceRefcntImpl.cpp	2008-12-17 09:03:37.000000000 -0500
@@ -828,7 +828,7 @@
 
   NS_DescribeCodeAddress(aPC, &details);
   NS_FormatCodeAddressDetails(aPC, &details, buf, sizeof(buf));
-  fprintf(stream, buf);
+  fprintf(stream, "%s", buf);
 }
 
 }