diff -urN texlive-20120701-source~/utils/chktex/chktex-1.6.6/ChkTeX.c texlive-20120701-source/utils/chktex/chktex-1.6.6/ChkTeX.c
--- texlive-20120701-source~/utils/chktex/chktex-1.6.6/ChkTeX.c	2012-04-10 03:21:16.000000000 +0400
+++ texlive-20120701-source/utils/chktex/chktex-1.6.6/ChkTeX.c	2012-12-25 01:56:34.028370678 +0400
@@ -350,7 +350,7 @@
         }
 
         if (!Quiet || LicenseOnly)
-            fprintf(stderr, Banner);
+            fprintf(stderr, "%s", Banner);
 
         if (CurArg == argc)
             UsingStdIn = TRUE;
@@ -368,7 +368,7 @@
 
         if ((UsingStdIn && StdInTTY && !Quiet) || LicenseOnly)
         {
-            fprintf(stderr, BigBanner);
+            fprintf(stderr, "%s", BigBanner);
         }
 
         if (!StdOutTTY && PipeOutputFormat)
@@ -376,7 +376,7 @@
 
         if (LicenseOnly)
         {
-            fprintf(stderr, Distrib);
+            fprintf(stderr, "%s", Distrib);
         }
         else
         {
@@ -953,7 +953,7 @@
                 nextc = ParseBoolArg(&HeadErrOut, &optarg);
                 break;
             case 'W':
-                printf(Banner);
+                printf("%s", Banner);
                 exit(EXIT_SUCCESS);
             case '?':
             default:
diff -urN texlive-20120701-source~/texk/devnag/src/devnag.c texlive-20120701-source/texk/devnag/src/devnag.c
--- texlive-20120701-source~/texk/devnag/src/devnag.c	2010-05-22 09:13:22.000000000 +0400
+++ texlive-20120701-source/texk/devnag/src/devnag.c	2012-12-25 14:57:25.357933241 +0400
@@ -2395,7 +2395,7 @@
 void err_ill(const char *str) {
    fprintf(stderr, "Error: illegal character(s) \"%s\" detected at line %d:\n",
 	  str, linenumber);
-   fprintf(stderr, inbuf);
+   fprintf(stderr, "%s", inbuf);
    exit(1);
 }
 
diff -urN texlive-20120701-source~/texk/dvidvi/dvidvi.c texlive-20120701-source/texk/dvidvi/dvidvi.c
--- texlive-20120701-source~/texk/dvidvi/dvidvi.c	2011-09-29 16:07:00.000000000 +0400
+++ texlive-20120701-source/texk/dvidvi/dvidvi.c	2012-12-25 14:59:00.854564760 +0400
@@ -331,7 +331,7 @@
  *   Print a usage error messsage, and quit.
  */
 static void usage(void) {
-   (void)fprintf(stderr,banner);
+   (void)fprintf(stderr,"%s",banner);
    (void)fprintf(stderr,"Usage:  dvidvi [options] input[.dvi] [output]\n");
    (void)fprintf(stderr,"where options are:\n");
    (void)fprintf(stderr,"    [-f n] first page printed     [-l n] last page printed\n");
@@ -810,7 +810,7 @@
       } /* else argument with '-' */
    }  /* for */
    if (*iname == 0) {
-       (void)fprintf(stderr, banner) ;
+       (void)fprintf(stderr, "%s", banner) ;
        error("! no input file specified");
    }
    /* Inserted by djc@dsmail.hmi.de 3.8.1994 */
@@ -821,7 +821,7 @@
    }
 
    if (*oname != 0 && !quiet) {
-       (void)fprintf(stderr, banner) ;
+       (void)fprintf(stderr, "%s", banner) ;
        (void)fprintf(stderr, "%s -> %s\n",iname,oname);
        temp = nextstring ;
    }
diff -urN texlive-20120701-source~/texk/ps2pkm/objects.h texlive-20120701-source/texk/ps2pkm/objects.h
--- texlive-20120701-source~/texk/ps2pkm/objects.h	2009-06-22 18:33:57.000000000 +0400
+++ texlive-20120701-source/texk/ps2pkm/objects.h	2012-12-25 15:05:34.311379602 +0400
@@ -232,7 +232,7 @@
 /*SHARED*/
 /* NDW: personally, I want to see status and error messages! */
 #define IfTrace0(condition,model)                                 \
-        {if (condition) printf(model);}
+        {if (condition) printf("%s", model);}
 #define IfTrace1(condition,model,arg0)                            \
         {if (condition) printf(model,arg0);}
 #define IfTrace2(condition,model,arg0,arg1)                       \
diff -urN texlive-20120701-source~/texk/web2c/cwebboot.cin texlive-20120701-source/texk/web2c/cwebboot.cin
--- texlive-20120701-source~/texk/web2c/cwebboot.cin	2010-01-18 19:11:52.000000000 +0300
+++ texlive-20120701-source/texk/web2c/cwebboot.cin	2012-12-25 02:39:43.040848745 +0400
@@ -1084,7 +1084,7 @@
  fatal(const char*s,const char*t)
 #line 1182 "cwebdir/common.w"
 {
-if(*s)printf(s);
+if(*s)printf("%s",s);
 err_print(t);
 history= fatal_message;exit(wrap_up());
 }
diff -urN texlive-20120701-source~/texk/web2c/cwebdir/common.c texlive-20120701-source/texk/web2c/cwebdir/common.c
--- texlive-20120701-source~/texk/web2c/cwebdir/common.c	2006-01-18 00:41:51.000000000 +0300
+++ texlive-20120701-source/texk/web2c/cwebdir/common.c	2012-12-25 02:33:17.405363875 +0400
@@ -1063,7 +1063,7 @@
 fatal(s,t)
 char*s,*t;
 {
-if(*s)printf(s);
+if(*s)printf("%s", s);
 err_print(t);
 history= fatal_message;exit(wrap_up());
 }
diff -urN texlive-20120701-source~/texk/web2c/cwebdir/common.w texlive-20120701-source/texk/web2c/cwebdir/common.w
--- texlive-20120701-source~/texk/web2c/cwebdir/common.w	2008-04-28 13:22:39.000000000 +0400
+++ texlive-20120701-source/texk/web2c/cwebdir/common.w	2012-12-25 02:34:05.737672340 +0400
@@ -1180,7 +1180,7 @@
 fatal(s,t)
   char *s,*t;
 {
-  if (*s) printf(s);
+  if (*s) printf("%s", s);
   err_print(t);
   history=fatal_message; exit(wrap_up());
 }
diff -urN texlive-20120701-source~/texk/web2c/cwebdir/cweave.w texlive-20120701-source/texk/web2c/cwebdir/cweave.w
--- texlive-20120701-source~/texk/web2c/cwebdir/cweave.w	2008-04-28 13:22:39.000000000 +0400
+++ texlive-20120701-source/texk/web2c/cwebdir/cweave.w	2012-12-25 15:09:36.226037765 +0400
@@ -1784,7 +1784,7 @@
 print_cat(c) /* symbolic printout of a category */
 eight_bits c;
 {
-  printf(cat_name[c]);
+  printf("%s", cat_name[c]);
 }
 
 @ The token lists for translated \TEX/ output contain some special control
diff -urN texlive-20120701-source~/texk/web2c/luatexdir/image/writeimg.w texlive-20120701-source/texk/web2c/luatexdir/image/writeimg.w
--- texlive-20120701-source~/texk/web2c/luatexdir/image/writeimg.w	2012-05-22 14:53:47.000000000 +0400
+++ texlive-20120701-source/texk/web2c/luatexdir/image/writeimg.w	2012-12-25 15:35:24.381313483 +0400
@@ -644,7 +644,7 @@
     sprintf(s, "/BBox [%.8f %.8f %.8f %.8f]\n", int2bp(img_bbox(idict)[0]),
             int2bp(img_bbox(idict)[1]), int2bp(img_bbox(idict)[2]),
             int2bp(img_bbox(idict)[3]));
-    pdf_printf(pdf, stripzeros(s));
+    pdf_printf(pdf, "%s", stripzeros(s));
     pdf_begin_stream(pdf);
     if (img_pdfstream_stream(idict) != NULL)
         pdf_puts(pdf, img_pdfstream_stream(idict));
diff -urN texlive-20120701-source~/texk/web2c/luatexdir/tex/printing.w texlive-20120701-source/texk/web2c/luatexdir/tex/printing.w
--- texlive-20120701-source~/texk/web2c/luatexdir/tex/printing.w	2012-05-21 19:21:54.000000000 +0400
+++ texlive-20120701-source/texk/web2c/luatexdir/tex/printing.w	2012-12-25 15:37:10.333020089 +0400
@@ -391,7 +391,7 @@
     print_char(' ');
     print_int(int_par(day_code));
     print_char(' ');
-    fprintf(log_file, months[month]);
+    fprintf(log_file, "%s", months[month]);
     print_char(' ');
     print_int(int_par(year_code));
     print_char(' ');
@@ -418,7 +418,7 @@
 @ @c
 void print_version_banner(void)
 {
-    fprintf(term_out, ptexbanner);
+    fprintf(term_out, "%s", ptexbanner);
 }
 
 @ The procedure |print_esc| prints a string that is preceded by
diff -urN texlive-20120701-source~/texk/web2c/omegafonts/error_routines.c texlive-20120701-source/texk/web2c/omegafonts/error_routines.c
--- texlive-20120701-source~/texk/web2c/omegafonts/error_routines.c	2009-11-10 13:27:09.000000000 +0300
+++ texlive-20120701-source/texk/web2c/omegafonts/error_routines.c	2012-12-25 15:43:05.518217399 +0400
@@ -36,7 +36,7 @@
 lex_error_0(const_string fmt)
 {
     fprintf(stderr, "line %d (lexing): ", line_number);
-    fprintf(stderr, fmt);
+    fprintf(stderr, "%s", fmt);
     fprintf(stderr, "\n");
 }
 
@@ -68,7 +68,7 @@
 yyerror(const_string fmt)
 {
     fprintf(stderr, "line %d (parsing): ", line_number);
-    fprintf(stderr, fmt);
+    fprintf(stderr, "%s", fmt);
     fprintf(stderr, "\n");
 }
 
@@ -77,7 +77,7 @@
 warning_0(const_string fmt)
 {
     fprintf(stderr, "line %d (warning): ", line_number);
-    fprintf(stderr, fmt);
+    fprintf(stderr, "%s", fmt);
     fprintf(stderr, "\n");
 }
 
@@ -125,7 +125,7 @@
 fatal_error_0(const_string fmt)
 {
     fprintf(stderr, "line %d (fatal): ", line_number);
-    fprintf(stderr, fmt);
+    fprintf(stderr, "%s", fmt);
     fprintf(stderr, "\n");
     exit(1);
 }
@@ -161,7 +161,7 @@
 internal_error_0(const_string fmt)
 {
     fprintf(stderr, "line %d (internal): ", line_number);
-    fprintf(stderr, fmt);
+    fprintf(stderr, "%s", fmt);
     fprintf(stderr, "\n");
     exit(2);
 }
diff -urN texlive-20120701-source~/texk/web2c/omegafonts/out_routines.c texlive-20120701-source/texk/web2c/omegafonts/out_routines.c
--- texlive-20120701-source~/texk/web2c/omegafonts/out_routines.c	2009-11-10 13:27:09.000000000 +0300
+++ texlive-20120701-source/texk/web2c/omegafonts/out_routines.c	2012-12-25 15:43:57.453575756 +0400
@@ -383,5 +383,5 @@
 void
 out(const_string sval)
 {
-	fprintf(file_output, sval);
+	fprintf(file_output, "%s", sval);
 }
diff -urN texlive-20120701-source~/texk/web2c/tiedir/tie.c texlive-20120701-source/texk/web2c/tiedir/tie.c
--- texlive-20120701-source~/texk/web2c/tiedir/tie.c	2006-01-18 00:41:51.000000000 +0300
+++ texlive-20120701-source/texk/web2c/tiedir/tie.c	2012-12-25 15:21:13.384307053 +0400
@@ -34,7 +34,7 @@
 #define new_line(v)fputc('\n',v)
 #define term_new_line new_line(term_out) \
 
-#define print_ln(v){fprintf(term_out,v);term_new_line;} \
+#define print_ln(v){fprintf(term_out,"%s",v);term_new_line;} \
 
 #define print2_ln(a,b){print2(a,b);term_new_line;}
 #define print3_ln(a,b,c){print3(a,b,c);term_new_line;} \
diff -urN texlive-20120701-source~/texk/web2c/tiedir/tie.w texlive-20120701-source/texk/web2c/tiedir/tie.w
--- texlive-20120701-source~/texk/web2c/tiedir/tie.w	2009-03-09 11:29:33.000000000 +0300
+++ texlive-20120701-source/texk/web2c/tiedir/tie.w	2012-12-25 15:30:30.256452565 +0400
@@ -465,7 +465,7 @@
 @d new_line(v)  fputc('\n',v) /* start new line */
 @d term_new_line  new_line(term_out)
 	/* start new line of the terminal */
-@d print_ln(v)  {fprintf(term_out,v);term_new_line;}
+@d print_ln(v)  {fprintf(term_out,"%s",v);term_new_line;}
 	/* `|print|' and then start new line */
 @d print2_ln(a,b)  {print2(a,b);term_new_line;} /* same with two arguments */
 @d print3_ln(a,b,c)  {print3(a,b,c);term_new_line;}