Index: src/tools/analysis-tools.c
===================================================================
--- src/tools/analysis-tools.c	(revision 16947)
+++ src/tools/analysis-tools.c	(working copy)
@@ -744,7 +744,7 @@
 
 	guint col, row;
 
-	dao_set_cell_printf (dao, 0, 0, title);
+	dao_set_cell_printf (dao, 0, 0, "%s", title);
 	dao_set_italic (dao, 0, 0, 0, 0);
 
 	fd = gnm_func_lookup (functionname, NULL);
@@ -5017,7 +5017,7 @@
 		for (i = given_length; i < desired_length; i++)
 			current->data = g_array_append_val (current->data, zero_val);
 
-		dao_set_cell_printf (dao, col, 0, current->label);
+		dao_set_cell_printf (dao, col, 0, "%s", current->label);
 		dao_set_cell_printf (dao, col, 1, _("Real"));
 		dao_set_cell_printf (dao, col + 1, 1, _("Imaginary"));
 
Index: src/stf.c
===================================================================
--- src/stf.c	(revision 16947)
+++ src/stf.c	(working copy)
@@ -391,7 +391,7 @@
 					 GTK_MESSAGE_WARNING,
 					 msg);
 			else
-				g_warning (msg);
+				g_warning ("%s", msg);
 #if 0
 				go_cmd_context_error_import
 					(GO_CMD_CONTEXT (context),
Index: src/ranges.c
===================================================================
--- src/ranges.c	(revision 16947)
+++ src/ranges.c	(working copy)
@@ -199,7 +199,7 @@
 		g_printerr (":%s%s",
 			col_name (src->end.col),
 			row_name (src->end.row));
-	g_printerr (suffix);
+	g_printerr ("%s", suffix);
 }
 
 #ifdef RANGE_DEBUG
Index: src/xml-sax-read.c
===================================================================
--- src/xml-sax-read.c	(revision 16947)
+++ src/xml-sax-read.c	(working copy)
@@ -2295,7 +2295,7 @@
 		if (texpr)
 			expr_name_set_expr (nexpr, texpr);
 		else
-			gnm_io_warning (state->context, perr.err->message);
+			gnm_io_warning (state->context, "%s", perr.err->message);
 
 		parse_error_free (&perr);
 		g_free (expr_str);
Index: src/print.c
===================================================================
--- src/print.c	(revision 16947)
+++ src/print.c	(working copy)
@@ -1513,7 +1513,7 @@
 
 	  tmp_file_fd = g_file_open_tmp ("pdfXXXXXX", &tmp_file_name, &err);
 	  if (err) {
-		  gsf_output_set_error (export_dst, 0, err->message);
+		  gsf_output_set_error (export_dst, 0, "%s", err->message);
 		  g_error_free (err);
 		  goto out;
 	  }
@@ -1570,7 +1570,7 @@
 		  if (!gsf_output_error (export_dst))
 			  gsf_output_set_error (export_dst,
 						g_file_error_from_errno (save_errno),
-						g_strerror (save_errno));
+						"%s", g_strerror (save_errno));
 	  }
   }
 
Index: src/gui-util.c
===================================================================
--- src/gui-util.c	(revision 16947)
+++ src/gui-util.c	(working copy)
@@ -931,7 +931,7 @@
 							   primary_message);
 			}
 		} else {
-			message = g_strdup_printf (secondary_message);
+			message = g_strdup_printf ("%s", secondary_message);
 		}
 		label = gtk_label_new (message);
 		g_free (message);
Index: src/xml-io.c
===================================================================
--- src/xml-io.c	(revision 16947)
+++ src/xml-io.c	(working copy)
@@ -400,11 +400,11 @@
 				       texpr,
 				       &err, TRUE, NULL);
 			if (err != NULL) {
-				gnm_io_warning (ctxt->io_context, err);
+				gnm_io_warning (ctxt->io_context, "%s", err);
 				g_free (err);
 			}
 		} else
-			gnm_io_warning (ctxt->io_context, perr.err->message);
+			gnm_io_warning (ctxt->io_context, "%s", perr.err->message);
 		parse_error_free (&perr);
 
 		xmlFree (name_str);
Index: src/sheet-object-image.c
===================================================================
--- src/sheet-object-image.c	(revision 16947)
+++ src/sheet-object-image.c	(working copy)
@@ -294,7 +294,7 @@
 		}
 
 		if (err != NULL) {
-			g_warning (err-> message);
+			g_warning ("%s", err->message);
 			g_error_free (err);
 			err = NULL;
 		} else {
Index: src/wbc-gtk.c
===================================================================
--- src/wbc-gtk.c	(revision 16947)
+++ src/wbc-gtk.c	(working copy)
@@ -2026,7 +2026,7 @@
 
 	dialog = gtk_message_dialog_new (wbcg_toplevel (wbcg),
 		GTK_DIALOG_DESTROY_WITH_PARENT,
-		type, GTK_BUTTONS_NONE, msg);
+		type, GTK_BUTTONS_NONE, "%s", msg);
 	gtk_dialog_add_buttons (GTK_DIALOG (dialog),
 		btn0, GTK_RESPONSE_YES,
 		btn1, GTK_RESPONSE_NO,
Index: src/stf-export.c
===================================================================
--- src/stf-export.c	(revision 16947)
+++ src/stf-export.c	(working copy)
@@ -667,7 +667,7 @@
 	errtxt = _("Invalid option for stf exporter");
 error:
 	if (err)
-		*err = g_error_new (go_error_invalid (), 0, errtxt);
+		*err = g_error_new (go_error_invalid (), 0, "%s", errtxt);
 
 	return TRUE;
 }
Index: plugins/dif/dif.c
===================================================================
--- plugins/dif/dif.c	(revision 16947)
+++ plugins/dif/dif.c	(working copy)
@@ -235,14 +235,14 @@
 				msg = g_strdup_printf (
 				      _("Unknown data value \"%s\" at line %d. Ignoring."),
 				      ctxt->line, ctxt->line_no);
-				g_warning (msg);
+				g_warning ("%s", msg);
 				g_free (msg);
 			}
 		} else {
 			msg = g_strdup_printf (
 			      _("Unknown value type %d at line %d. Ignoring."),
 			      val_type, ctxt->line_no);
-			g_warning (msg);
+			g_warning ("%s", msg);
 			g_free (msg);
 			(void) dif_get_line (ctxt);
 		}
Index: plugins/excel/boot.c
===================================================================
--- plugins/excel/boot.c	(revision 16947)
+++ plugins/excel/boot.c	(working copy)
@@ -131,7 +131,7 @@
 	if (stream != NULL) {
 		GError *err = gsf_msole_metadata_read (stream, meta_data);
 		if (err != NULL) {
-			gnm_io_warning (context, err->message);
+			gnm_io_warning (context, "%s", err->message);
 			g_error_free (err);
 		}
 
Index: plugins/excel/ms-excel-read.c
===================================================================
--- plugins/excel/ms-excel-read.c	(revision 16947)
+++ plugins/excel/ms-excel-read.c	(working copy)
@@ -3245,7 +3245,7 @@
 			       texpr,
 			       &err, link_to_container, stub);
 	if (nexpr == NULL) {
-		gnm_io_warning (importer->context, err);
+		gnm_io_warning (importer->context, "%s", err);
 		g_free (err);
 		return NULL;
 	}
