--- lib/command.c.str	2009-04-03 17:18:05.000000000 +0200
+++ lib/command.c	2009-04-03 17:18:24.000000000 +0200
@@ -3052,7 +3052,7 @@
   if ((level = level_match(argv[0])) == ZLOG_DISABLED)
     return CMD_ERR_NO_MATCH;
 
-  zlog(NULL, level, ((message = argv_concat(argv, argc, 1)) ? message : ""));
+  zlog(NULL, level, "%s", ((message = argv_concat(argv, argc, 1)) ? message : ""));
   if (message)
     XFREE(MTYPE_TMP, message);
   return CMD_SUCCESS;
--- lib/if.c.str	2009-04-03 17:18:45.000000000 +0200
+++ lib/if.c	2009-04-03 17:19:01.000000000 +0200
@@ -664,7 +664,7 @@
       strncat (logbuf, inet_ntop (p->family, &p->u.prefix, buf, BUFSIZ),
 	       BUFSIZ - strlen(logbuf));
     }
-  zlog (NULL, LOG_INFO, logbuf);
+  zlog (NULL, LOG_INFO, "%s", logbuf);
 }
 
 /* If two connected address has same prefix return 1. */
--- lib/vty.c.str	2009-04-03 17:17:35.000000000 +0200
+++ lib/vty.c	2009-04-03 17:17:50.000000000 +0200
@@ -250,7 +250,7 @@
 	vty_out (vty, "MOTD file not found%s", VTY_NEWLINE);
     }
   else if (host.motd)
-    vty_out (vty, host.motd);
+    vty_out (vty, "%s", host.motd);
 }
 
 /* Put out prompt and wait input from user. */