--- mozilla/xpcom/base/nsTraceRefcntImpl.cpp	2009-12-11 18:07:57.000000000 +0000
+++ mozilla/xpcom/base/nsTraceRefcntImpl.cpp.new	2009-12-28 13:11:40.345150646 +0000
@@ -834,7 +834,7 @@
 
   NS_DescribeCodeAddress(aPC, &details);
   NS_FormatCodeAddressDetails(aPC, &details, buf, sizeof(buf));
-  fprintf(stream, buf);
+  fprintf(stream, "%s", buf);
 }
 
 }
--- mozilla/js/src/xpconnect/shell/xpcshell.cpp.str	2008-12-31 14:02:58.000000000 -0500
+++ mozilla/js/src/xpconnect/shell/xpcshell.cpp	2008-12-31 14:03:20.000000000 -0500
@@ -542,7 +542,7 @@
 #endif
     {
         char line[256];
-        fprintf(gOutFile, prompt);
+        fprintf(gOutFile, "%s", prompt);
         fflush(gOutFile);
         if (!fgets(line, sizeof line, file))
             return JS_FALSE;
--- mozilla/widget/src/gtk2/nsFilePicker.cpp.str	2008-12-31 14:28:59.000000000 -0500
+++ mozilla/widget/src/gtk2/nsFilePicker.cpp	2008-12-31 14:29:13.000000000 -0500
@@ -480,6 +480,7 @@
                                   GTK_DIALOG_DESTROY_WITH_PARENT,
                                   GTK_MESSAGE_QUESTION,
                                   GTK_BUTTONS_YES_NO,
+				  "%s",
                                   NS_ConvertUTF16toUTF8(message).get());
   gtk_window_set_title(GTK_WINDOW(dialog), NS_ConvertUTF16toUTF8(title).get());
   if (parent_window && parent_window->group) {
--- mozilla/js/src/xpconnect/tests/TestXPC.cpp	2009-12-11 18:07:03.000000000 +0000
+++ mozilla/js/src/xpconnect/tests/TestXPC.cpp.new	2009-12-28 13:34:44.714078165 +0000
@@ -130,7 +130,7 @@
 static void
 my_ErrorReporter(JSContext *cx, const char *message, JSErrorReport *report)
 {
-    printf(message);
+    printf("%s", message);
 }
 
 /***************************************************************************/
@@ -610,7 +610,7 @@
             rv = e->ToString(&str);
             if(NS_SUCCEEDED(rv) && str)
             {
-                printf(str);
+                printf("%s", str);
                 printf("\n");
                 nsMemory::Free(str);
 
--- ./mozilla/js/src/xpconnect/tests/components/xpctest_echo.cpp	2009-12-11 18:07:03.000000000 +0000
+++ ./mozilla/js/src/xpconnect/tests/components/xpctest_echo.cpp.new	2009-12-28 13:48:30.402196771 +0000
@@ -483,7 +483,7 @@
         else if (JSVAL_IS_VOID(argv[i]))
             type = "void";
 
-        printf(type);
+        printf("%s", type);
 
         if(i < argc-1)
             printf(", ");