--- bacula-2.4.3/src/stored/btape.c	2008-04-01 02:31:06.000000000 -0700
+++ bacula-2.4.3/src/stored/btape.c.new	2008-12-27 13:45:22.000000000 -0800
@@ -2621,7 +2621,7 @@
 {
    int i = 0;
    int ch;
-   fprintf(stdout, prompt);
+   fprintf(stdout, "%s", prompt);
 
    /* We really should turn off echoing and pretty this
     * up a bit.
--- bacula-2.4.3/src/tray-monitor/tray-monitor.c	2007-10-16 12:00:51.000000000 -0700
+++ bacula-2.4.3/src/tray-monitor/tray-monitor.c.new	2008-12-27 14:10:16.000000000 -0800
@@ -1062,7 +1062,7 @@
    bvsnprintf(buf, sizeof(buf), (char *)fmt, arg_ptr);
    va_end(arg_ptr);
 
-   fprintf(stderr, buf);
+   fprintf(stderr, "%s", buf);
 
 // gtk_tray_icon_send_message(gtk_status_icon_get_tray_icon(mTrayIcon), 5000, (const char*)&buf, -1);
 }