diff --git a/libexec/pppoed/pppoed.c b/libexec/pppoed/pppoed.c
index aae546cea6bd..d1878f795bff 100644
--- a/libexec/pppoed/pppoed.c
+++ b/libexec/pppoed/pppoed.c
@@ -82,7 +82,7 @@ Fairwell(int sig)
   buf[16] = '0' + ((sig / 10) % 10);
   buf[17] = '0' + (sig % 10);
 
-  syslog(LOG_INFO, buf);
+  syslog(LOG_INFO, "%s", buf);
 
   if (pidfile)
     remove(pidfile);
diff --git a/sbin/ping/ping.c b/sbin/ping/ping.c
index 39e6bec4f144..14db65134568 100644
--- a/sbin/ping/ping.c
+++ b/sbin/ping/ping.c
@@ -471,7 +471,7 @@ main(argc, argv)
 		if (policy_in != NULL) {
 			buf = ipsec_set_policy(policy_in, strlen(policy_in));
 			if (buf == NULL)
-				errx(EX_CONFIG, ipsec_strerror());
+				errx(EX_CONFIG, "%s", ipsec_strerror());
 			if (setsockopt(s, IPPROTO_IP, IP_IPSEC_POLICY,
 					buf, ipsec_get_policylen(buf)) < 0)
 				err(EX_CONFIG, "ipsec policy cannot be configured");
@@ -481,7 +481,7 @@ main(argc, argv)
 		if (policy_out != NULL) {
 			buf = ipsec_set_policy(policy_out, strlen(policy_out));
 			if (buf == NULL)
-				errx(EX_CONFIG, ipsec_strerror());
+				errx(EX_CONFIG, "%s", ipsec_strerror());
 			if (setsockopt(s, IPPROTO_IP, IP_IPSEC_POLICY,
 					buf, ipsec_get_policylen(buf)) < 0)
 				err(EX_CONFIG, "ipsec policy cannot be configured");
diff --git a/usr.sbin/rrenumd/rrenumd.c b/usr.sbin/rrenumd/rrenumd.c
index 9d150ac6f81e..fa3257d9c059 100644
--- a/usr.sbin/rrenumd/rrenumd.c
+++ b/usr.sbin/rrenumd/rrenumd.c
@@ -293,7 +293,7 @@ sock6_open(struct flags *flags
 		char *buf;
 		buf = ipsec_set_policy(policy, strlen(policy));
 		if (buf == NULL)
-			errx(1, ipsec_strerror());
+			errx(1, "%s", ipsec_strerror());
 		/* XXX should handle in/out bound policy. */
 		if (setsockopt(s6, IPPROTO_IPV6, IPV6_IPSEC_POLICY,
 				buf, ipsec_get_policylen(buf)) < 0)
@@ -359,7 +359,7 @@ sock4_open(struct flags *flags
 		char *buf;
 		buf = ipsec_set_policy(policy, strlen(policy));
 		if (buf == NULL)
-			errx(1, ipsec_strerror());
+			errx(1, "%s", ipsec_strerror());
 		/* XXX should handle in/out bound policy. */
 		if (setsockopt(s4, IPPROTO_IP, IP_IPSEC_POLICY,
 				buf, ipsec_get_policylen(buf)) < 0)