diff -ruN dia-0.94.0.orig/app/app_procs.c dia-0.94.0/app/app_procs.c
--- dia-0.94.0.orig/app/app_procs.c	2006-06-04 15:33:05.000000000 +0200
+++ dia-0.94.0/app/app_procs.c	2006-06-04 15:33:56.000000000 +0200
@@ -879,22 +879,22 @@
 
       g_print(_("The original author of Dia was:\n\n"));
       for (i = 0; i < NUMBER_OF_ORIG_AUTHORS; i++) {
-          g_print(authors[i]); g_print("\n");
+          g_print("%s\n", authors[i]);
       }
 
       g_print(_("\nThe current maintainers of Dia are:\n\n"));
       for (i = NUMBER_OF_ORIG_AUTHORS; i < NUMBER_OF_ORIG_AUTHORS + NUMBER_OF_MAINTAINERS; i++) {
-	  g_print(authors[i]); g_print("\n");
+	  g_print("%s\n", authors[i]);
       }
 
       g_print(_("\nOther authors are:\n\n"));
       for (i = NUMBER_OF_ORIG_AUTHORS + NUMBER_OF_MAINTAINERS; i < nauthors; i++) {
-          g_print(authors[i]); g_print("\n");
+          g_print("%s\n", authors[i]);
       }
 
       g_print(_("\nDia is documented by:\n\n"));
       for (i = 0; i < ndocumentors; i++) {
-          g_print(documentors[i]); g_print("\n");
+          g_print("%s\n", documentors[i]);
       }
 
       exit(0);
diff -ruN dia-0.94.0.orig/app/display.c dia-0.94.0/app/display.c
--- dia-0.94.0.orig/app/display.c	2004-08-16 09:56:03.000000000 +0200
+++ dia-0.94.0/app/display.c	2006-06-04 15:51:00.000000000 +0200
@@ -968,7 +968,6 @@
   Diagram *dia;
   GtkWidget *dialog, *button;
   gchar *fname;
-  gchar *msg;
 
   dia = ddisp->diagram;
   
@@ -981,18 +980,16 @@
   fname = dia->filename;
   if (!fname)
     fname = _("<unnamed>");
-  msg = g_strdup_printf (
-          _("The diagram '%s'\n"
-            "has not been saved. Save changes now?"),
-	  fname);
 
   dialog = gtk_message_dialog_new(GTK_WINDOW (ddisp->shell), 
                                   GTK_DIALOG_MODAL,
                                   GTK_MESSAGE_QUESTION,
                                   GTK_BUTTONS_NONE, /* no standard buttons */
-				  msg,
+				  _("Closing diagram without saving"),
                                   NULL);
-  g_free (msg);
+  gtk_message_dialog_format_secondary_text(GTK_MESSAGE_DIALOG(dialog),
+    _("The diagram '%s'\n"
+      "has not been saved. Save changes now?"), fname);
   gtk_window_set_title (GTK_WINDOW(dialog), _("Close Diagram"));
 
   button = gtk_button_new_from_stock (GTK_STOCK_CANCEL);
diff -ruN dia-0.94.0.orig/app/filedlg.c dia-0.94.0/app/filedlg.c
--- dia-0.94.0.orig/app/filedlg.c	2004-08-16 09:56:03.000000000 +0200
+++ dia-0.94.0/app/filedlg.c	2006-06-04 16:04:10.000000000 +0200
@@ -251,7 +251,6 @@
 
   if (stat(filename, &stat_struct) == 0) {
     GtkWidget *dialog = NULL;
-    char buffer[300];
     char *utf8filename = NULL;
     if (!g_utf8_validate(filename, -1, NULL)) {
       utf8filename = g_filename_to_utf8(filename, -1, NULL, NULL, NULL);
@@ -261,16 +260,14 @@
     }
     if (utf8filename == NULL) utf8filename = g_strdup(filename);
 
-    g_snprintf(buffer, 300,
-	       _("The file '%s' already exists.\n"
-		 "Do you want to overwrite it?"), utf8filename);
-    g_free(utf8filename);
-
     dialog = gtk_message_dialog_new (GTK_WINDOW(fs),
                                      GTK_DIALOG_MODAL, GTK_MESSAGE_QUESTION,
                                      GTK_BUTTONS_YES_NO,
-                                     buffer);
-    gtk_window_set_title (GTK_WINDOW (dialog), _("File already exists"));
+                                     _("File already exists"));
+    gtk_message_dialog_format_secondary_text(GTK_MESSAGE_DIALOG(dialog),
+      _("The file '%s' already exists.\n"
+        "Do you want to overwrite it?"), utf8filename);
+    g_free(utf8filename);
     gtk_dialog_set_default_response (GTK_DIALOG (dialog), GTK_RESPONSE_YES);
 
     if (gtk_dialog_run (GTK_DIALOG (dialog)) != GTK_RESPONSE_YES) {
@@ -442,17 +439,15 @@
 
   if (stat(filename, &statbuf) == 0) {
     GtkWidget *dialog = NULL;
-    char buffer[300];
 
-    g_snprintf(buffer, 300,
-	       _("The file '%s' already exists.\n"
-		 "Do you want to overwrite it?"), filename);
     dialog = gtk_message_dialog_new (GTK_WINDOW(fs),
                                      GTK_DIALOG_MODAL | GTK_DIALOG_DESTROY_WITH_PARENT, 
 				     GTK_MESSAGE_QUESTION,
                                      GTK_BUTTONS_YES_NO,
-                                     buffer);
-    gtk_window_set_title (GTK_WINDOW (dialog), _("File already exists"));
+                                     _("File already exists"));
+    gtk_message_dialog_format_secondary_text(GTK_MESSAGE_DIALOG(dialog),
+      _("The file '%s' already exists.\n"
+        "Do you want to overwrite it?"), filename);
     gtk_dialog_set_default_response (GTK_DIALOG (dialog), GTK_RESPONSE_YES);
 
     if (gtk_dialog_run (GTK_DIALOG (dialog)) != GTK_RESPONSE_YES) {
diff -ruN dia-0.94.0.orig/app/load_save.c dia-0.94.0/app/load_save.c
--- dia-0.94.0.orig/app/load_save.c	2004-08-16 09:56:03.000000000 +0200
+++ dia-0.94.0/app/load_save.c	2006-06-04 15:33:56.000000000 +0200
@@ -199,7 +199,7 @@
     g_hash_table_foreach(unknown_hash,
 			 GHFuncUnknownObjects,
 			 unknown_str);
-    message_error(unknown_str->str);
+    message_error("%s", unknown_str->str);
   }
   g_hash_table_destroy(unknown_hash);
   g_string_free(unknown_str, TRUE);
diff -ruN dia-0.94.0.orig/app/sheets.c dia-0.94.0/app/sheets.c
--- dia-0.94.0.orig/app/sheets.c	2004-08-16 09:56:03.000000000 +0200
+++ dia-0.94.0/app/sheets.c	2006-06-04 16:07:45.000000000 +0200
@@ -338,7 +338,7 @@
         gdk_pixbuf_render_pixmap_and_mask(pixbuf, pixmap, mask, 1.0);
         gdk_pixbuf_unref(pixbuf);
       } else {
-        g_warning (error->message);
+        g_warning ("%s", error->message);
         g_error_free (error);
       }
     }
diff -ruN dia-0.94.0.orig/debian/changelog dia-0.94.0/debian/changelog
--- dia-0.94.0.orig/debian/changelog	2006-06-04 15:33:05.000000000 +0200
+++ dia-0.94.0/debian/changelog	2006-06-04 16:15:31.000000000 +0200
@@ -1,3 +1,10 @@
+dia (0.94.0-7sarge4) stable-security; urgency=high
+
+  * Applied upstream format string fixes: CVE-2006-2480 and CVE-2006-2453
+    (Closes: #368202)
+
+ -- Roland Stigge <stigge@antcom.de>  Sun,  4 Jun 2006 16:14:35 +0200
+
 dia (0.94.0-7sarge3) stable-security; urgency=medium
 
   * Non-maintainer upload by the Security Team
diff -ruN dia-0.94.0.orig/lib/message.c dia-0.94.0/lib/message.c
--- dia-0.94.0.orig/lib/message.c	2004-08-16 09:56:07.000000000 +0200
+++ dia-0.94.0/lib/message.c	2006-06-04 15:33:56.000000000 +0200
@@ -86,7 +86,7 @@
 				   0,    /* GtkDialogFlags */
 				   type,
 				   GTK_BUTTONS_CLOSE,
-				   buf);
+				   "%s", buf);
   if (title) {
     gchar *real_title;
 
diff -ruN dia-0.94.0.orig/plug-ins/python/diamodule.c dia-0.94.0/plug-ins/python/diamodule.c
--- dia-0.94.0.orig/plug-ins/python/diamodule.c	2004-08-16 09:56:20.000000000 +0200
+++ dia-0.94.0/plug-ins/python/diamodule.c	2006-06-04 15:33:56.000000000 +0200
@@ -377,11 +377,11 @@
 	return NULL;
 
     if (0 == type)
-	message_notice (text);
+	message_notice ("%s", text);
     else if (1 == type)
-	message_warning (text);
+	message_warning ("%s", text);
     else
-	message_error (text);
+	message_error ("%s", text);
 
     Py_INCREF(Py_None);
     return Py_None;
diff -ruN dia-0.94.0.orig/plug-ins/wmf/wmf.cpp dia-0.94.0/plug-ins/wmf/wmf.cpp
--- dia-0.94.0.orig/plug-ins/wmf/wmf.cpp	2004-08-16 09:56:21.000000000 +0200
+++ dia-0.94.0/plug-ins/wmf/wmf.cpp	2006-06-04 15:33:56.000000000 +0200
@@ -223,7 +223,7 @@
     va_end (args);
 
     //fprintf(renderer->file, string);
-    g_print(string);
+    g_print("%s", string);
 
     g_free(string);
 }
