diff --git a/isdn4k-fix-Werror-format-security-ftbfs.patch b/isdn4k-fix-Werror-format-security-ftbfs.patch
new file mode 100644
index 0000000..1500fc9
--- /dev/null
+++ b/isdn4k-fix-Werror-format-security-ftbfs.patch
@@ -0,0 +1,89 @@
+--- isdn4k-utils-CVS-2010-05-01-patched/isdnlog/isdnlog/asn1_address.c	2006-01-15 10:08:55.000000000 -0500
++++ isdn4k-utils-CVS-2010-05-01-patched.new/isdnlog/isdnlog/asn1_address.c	2014-01-28 16:59:10.588350961 -0500
+@@ -160,7 +160,7 @@
+ 	XSEQUENCE_1(ParsePartyNumber, ASN1_NOT_TAGGED, ASN1_NOT_TAGGED, partyNumber);
+ 	XSEQUENCE_OPT_1(ParsePartySubaddress, ASN1_NOT_TAGGED, ASN1_NOT_TAGGED, partySubaddress);
+ 
+-	str += sprintf(str, partyNumber);
++	str += sprintf(str, "%s", partyNumber);
+ 	if (strlen(partySubaddress))
+ 		str += sprintf(str, ".%s", partySubaddress);
+ 
+@@ -191,13 +191,13 @@
+ 	
+ 	switch (publicTypeOfNumber) {
+ 	case 0: break; // unknown
+-	case 1: str += sprintf(str, countryprefix); break;
+-	case 2: str += sprintf(str, areaprefix); break;
++	case 1: str += sprintf(str, "%s", countryprefix); break;
++	case 2: str += sprintf(str, "%s", areaprefix); break;
+ 	case 3: str += sprintf(str, "(network)"); break;
+ 	case 4: str += sprintf(str, "(MSN)"); break;
+ 	case 6: str += sprintf(str, "(abbrev)"); break;
+ 	}
+-	str += sprintf(str, numberDigits);
++	str += sprintf(str, "%s", numberDigits);
+ 
+ 	return p - beg;
+ }
+@@ -219,7 +219,7 @@
+ 	case 4: str += sprintf(str, "(local)"); break;
+ 	case 6: str += sprintf(str, "(abbrev)"); break;
+ 	}
+-	str += sprintf(str, numberDigits);
++	str += sprintf(str, "%s", numberDigits);
+ 
+ 	return p - beg;
+ }
+--- isdn4k-utils-CVS-2010-05-01-patched/isdnlog/isdnrep/isdnbill.c	2009-10-20 05:07:28.000000000 -0400
++++ isdn4k-utils-CVS-2010-05-01-patched.new/isdnlog/isdnrep/isdnbill.c	2014-01-28 17:16:00.533957441 -0500
+@@ -271,8 +271,7 @@
+   memset(s, c, len);
+   s[len] = 0;
+ 
+-  printf(s);
+-  printf("\n");
++  printf("%s\n", s);
+ } /* strich */
+ 
+ 
+--- isdn4k-utils-CVS-2010-05-01-patched/ipppd/main.c	2014-01-28 17:03:10.210704733 -0500
++++ isdn4k-utils-CVS-2010-05-01-patched.new/ipppd/main.c	2014-01-28 17:26:35.492407144 -0500
+@@ -240,7 +240,7 @@
+         }
+     }
+     if (!ppp_ok) {
+-        fprintf(stderr, no_ppp_msg);
++        fprintf(stderr, "%s", no_ppp_msg);
+         exit(1);
+     }
+ 
+--- isdn4k-utils-CVS-2010-05-01-patched/vbox/src/script.c	2000-11-30 10:35:20.000000000 -0500
++++ isdn4k-utils-CVS-2010-05-01-patched.new/vbox/src/script.c	2014-01-28 17:49:49.867794135 -0500
+@@ -450,7 +450,7 @@
+ 				break;
+ 
+ 			case VOICE_ACTION_TOUCHTONES:
+-				printstring(ip->result, touchtones);
++				printstring(ip->result, "%s", touchtones);
+ 				touchtones[0] = '\0';
+ 				break;
+ 
+@@ -499,7 +499,7 @@
+ 				break;
+ 
+ 			case VOICE_ACTION_TOUCHTONES:
+-				printstring(ip->result, touchtones);
++				printstring(ip->result, "%s", touchtones);
+ 				touchtones[0] = '\0';
+ 				break;
+ 
+@@ -548,7 +548,7 @@
+ 				break;
+ 
+ 			case VOICE_ACTION_TOUCHTONES:
+-				printstring(ip->result, touchtones);
++				printstring(ip->result, "%s", touchtones);
+ 				touchtones[0] = '\0';
+ 				break;
+ 
diff --git a/isdn4k-utils.spec b/isdn4k-utils.spec
index 3118b02..c1d3837 100644
--- a/isdn4k-utils.spec
+++ b/isdn4k-utils.spec
@@ -46,6 +46,7 @@ Patch24: isdn4k-fix-ipppd.patch
 Patch25: isdn4k-utils-capi20-link.patch
 Patch26: isdn4k-utils-CVS-2010-05-01-patched-legal-fixes.patch
 Patch27: isdn4k-utils-CVS-2010-05-01-patched-strict-aliasing.patch
+Patch28: isdn4k-fix-Werror-format-security-ftbfs.patch
 
 Requires: udev >= 039-10.14.EL4
 Requires: hwdata >= 0.146.18.EL-1
@@ -153,6 +154,7 @@ The isdn4k-utils-doc package contains the documentation for isdn4k-utils.
 %patch25 -p1 -b .capi20-link
 %patch26 -p1 -b .legal
 %patch27 -p1 -b .no-strict-aliasing
+%patch28 -p1 -b .format-security
 
 # remove useless files
 find -type d -name "CVS" | xargs rm -rf
@@ -398,6 +400,8 @@ echo "# config files" >> %{buildroot}/etc/ppp/ioptions
 %changelog
 * Tue Jan 28 2014 Kyle McMartin <kyle@fedoraproject.org> - 3.2-94
 - isdn4k-fix-ipppd.patch: fix build on aarch64 (and future arches)
+- isdn4k-fix-Werror-format-security-ftbfs.patch: fix FTBFS with
+  -Werror=format-security by explicitly using string types. (rhbz#1037140)
 
 * Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.2-93
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild