package: docbook-utils-0.6-11 The db2pdf(*), db2dvi, db2ps, and db2rtf are all of style: #! /bin/sh jw -f docbook -b rtf $* while they should be: #! /bin/sh jw -f docbook -b rtf "$*" in case any of the passed options have IFS characters in them... (*) The db2pdf is at package docbook-utils-pdf which isn't listed at RH component dataset.
(ITYM "$@".) Thanks for spotting it.
Fixed in docbook-utils-0.6-12 in rawhide, although I don't think it's really a security issue.