--- freeradius-server-2.2.0/src/modules/rlm_ruby/rlm_ruby.c~	2012-12-07 08:22:05.957883039 +0100
+++ freeradius-server-2.2.0/src/modules/rlm_ruby/rlm_ruby.c	2012-12-07 08:27:18.491205348 +0100
@@ -91,7 +91,7 @@
     char *msg;
     status = FIX2INT(msg_type);
     msg = STR2CSTR(rb_msg);
-    radlog(status, msg);
+    radlog(status, "%s", msg);
     return Qnil;
 }
 
--- freeradius-server-2.2.6/src/modules/rlm_sql/drivers/rlm_sql_oracle/sql_oracle.c.orig	2014-11-18 20:56:52.000000000 +0100
+++ freeradius-server-2.2.6/src/modules/rlm_sql/drivers/rlm_sql_oracle/sql_oracle.c	2015-03-22 07:30:08.669953101 +0100
@@ -242,7 +242,7 @@
 	rlm_sql_oracle_sock *oracle_sock = sqlsocket->conn;
 
 	if (config->sqltrace)
-		DEBUG(querystr);
+		DEBUG("%s", querystr);
 	if (oracle_sock->conn == NULL) {
 		radlog(L_ERR, "rlm_sql_oracle: Socket not connected");
 		return SQL_DOWN;
@@ -300,7 +300,7 @@
 	rlm_sql_oracle_sock *oracle_sock = sqlsocket->conn;
 
 	if (config->sqltrace)
-		DEBUG(querystr);
+		DEBUG("%s", querystr);
 	if (oracle_sock->conn == NULL) {
 		radlog(L_ERR, "rlm_sql_oracle: Socket not connected");
 		return SQL_DOWN;