--- src/8svx.c.orig
+++ src/8svx.c
@@ -161,7 +161,7 @@ static int startread(sox_format_t * ft)
         chan1_pos = lsx_tell(ft);
 
         for (i = 1; i < channels; i++) {
-                if ((p->ch[i] = fopen(ft->filename, "rb")) == NULL)
+                if ((p->ch[i] = fopen(ft->filename, "rbe")) == NULL)
                 {
                         lsx_fail_errno(ft,errno,"Can't open channel file '%s'",
                                 ft->filename);
--- src/effects_i.c.orig
+++ src/effects_i.c
@@ -350,7 +350,7 @@ FILE * lsx_open_input_file(sox_effect_t
     effp->global_info->global_info->stdin_in_use_by = effp->handler.name;
     file = stdin;
   }
-  else if (!(file = fopen(filename, "r"))) {
+  else if (!(file = fopen(filename, "re"))) {
     lsx_fail("couldn't open file %s: %s", filename, strerror(errno));
     return NULL;
   }
--- src/noiseprof.c.orig
+++ src/noiseprof.c
@@ -75,7 +75,7 @@ static int sox_noiseprof_start(sox_effec
     effp->global_info->global_info->stdout_in_use_by = effp->handler.name;
     data->output_file = stdout;
   }
-  else if ((data->output_file = fopen(data->output_filename, "w")) == NULL) {
+  else if ((data->output_file = fopen(data->output_filename, "we")) == NULL) {
     lsx_fail("Couldn't open profile file %s: %s", data->output_filename, strerror(errno));
     return SOX_EOF;
   }
--- src/sox.c.orig
+++ src/sox.c
@@ -852,7 +852,7 @@ static char * * strtoargv(char * s, int
 
 static void read_user_effects(char *filename)
 {
-    FILE *file = fopen(filename, "rt");
+    FILE *file = fopen(filename, "rte");
     char s[FILENAME_MAX];
     int argc;
     char * * argv;
@@ -1189,7 +1189,7 @@ static int kbhit(void)
 static void adjust_volume(int delta)
 {
   char * from_env = getenv("MIXERDEV");
-  int vol1 = 0, vol2 = 0, fd = open(from_env? from_env : "/dev/mixer", O_RDWR);
+  int vol1 = 0, vol2 = 0, fd = open(from_env? from_env : "/dev/mixer", O_RDWR|O_CLOEXEC);
   if (fd >= 0) {
     if (ioctl(fd, MIXER_READ(SOUND_MIXER_PCM), &vol1) != -1) {
       int side1 = vol1 & 0xff, side2 = (vol1 >> 8) & 0xff;
@@ -1983,7 +1983,7 @@ static void read_comment_file(sox_commen
   int c;
   size_t text_length = 100;
   char * text = lsx_malloc(text_length + 1);
-  FILE * file = fopen(filename, "rt");
+  FILE * file = fopen(filename, "rte");
 
   if (file == NULL) {
     lsx_fail("Cannot open comment file `%s'", filename);
--- src/spectrogram.c.orig
+++ src/spectrogram.c
@@ -491,7 +491,7 @@ static int axis(double to, int max_steps
 static int stop(sox_effect_t * effp)
 {
   priv_t *    p        = (priv_t *) effp->priv;
-  FILE *      file     = fopen(p->out_name, "wb");
+  FILE *      file     = fopen(p->out_name, "wbe");
   uLong       font_len = 96 * font_y;
   int         chans    = effp->in_signal.channels;
   int         c_rows   = p->rows * chans + chans - 1;
--- src/formats.c.orig
+++ src/formats.c
@@ -366,7 +366,7 @@ static FILE * xfopen(char const * identi
   if (*identifier == '|') {
     FILE * f = NULL;
 #ifdef HAVE_POPEN
-    f = popen(identifier + 1, "r");
+    f = popen(identifier + 1, "re");
     *io_type = lsx_io_pipe;
 #else
     lsx_fail("this build of SoX cannot open pipes");
@@ -375,11 +375,12 @@ static FILE * xfopen(char const * identi
   }
   else if (is_url(identifier)) {
     FILE * f = NULL;
+/* XXX: really folks ? forking a wget process to get an URL.. (!!!!!) */
 #ifdef HAVE_POPEN
     char const * const command_format = "wget --no-check-certificate -q -O- \"%s\"";
     char * command = lsx_malloc(strlen(command_format) + strlen(identifier));
     sprintf(command, command_format, identifier);
-    f = popen(command, "r");
+    f = popen(command, "re");
     free(command);
     *io_type = lsx_io_url;
 #else
@@ -451,7 +452,7 @@ static sox_format_t * open_read(
 #ifdef HAVE_FMEMOPEN
         buffer? fmemopen(buffer, buffer_size, "rb") :
 #endif
-        xfopen(path, "rb", &ft->io_type);
+        xfopen(path, "rbe", &ft->io_type);
       type = io_types[ft->io_type];
       if (ft->fp == NULL) {
         lsx_fail("can't open input %s `%s': %s", type, path, strerror(errno));
@@ -849,7 +850,7 @@ static sox_format_t * open_write(
         buffer? fmemopen(buffer, buffer_size, "w+b") :
         buffer_ptr? open_memstream(buffer_ptr, buffer_size_ptr) :
 #endif
-        fopen(path, "w+b");
+        fopen(path, "w+be");
       if (ft->fp == NULL) {
         lsx_fail("can't open output file `%s': %s", path, strerror(errno));
         goto error;
@@ -1059,7 +1060,7 @@ int sox_parse_playlist(sox_playlist_call
   char * dirname = lsx_strdup(listname);
   char * slash_pos = LAST_SLASH(dirname);
   lsx_io_type io_type;
-  FILE * file = xfopen(listname, "r", &io_type);
+  FILE * file = xfopen(listname, "re", &io_type);
   char * filename;
   int c, result = SOX_SUCCESS;
 
--- src/libsox_i.c.orig
+++ src/libsox_i.c
@@ -34,7 +34,7 @@
 #else
   #define MKTEMP_X 0
 #endif
-
+#include <fcntl.h>
 #ifndef HAVE_MKSTEMP
   #include <fcntl.h>
   #include <sys/types.h>
@@ -54,7 +54,7 @@ FILE * lsx_tmpfile(void)
     int fildes;
     strcpy(name, sox_globals.tmp_path);
     strcat(name, end);
-    fildes = mkstemp(name);
+    fildes = mkostemp(name, O_CLOEXEC);
 #ifdef HAVE_UNISTD_H
     lsx_debug(FAKE_MKSTEMP "mkstemp, name=%s (unlinked)", name);
     unlink(name);
@@ -62,7 +62,7 @@ FILE * lsx_tmpfile(void)
     lsx_debug(FAKE_MKSTEMP "mkstemp, name=%s (O_TEMPORARY)", name);
 #endif
     free(name);
-    return fildes == -1? NULL : fdopen(fildes, "w+");
+    return fildes == -1? NULL : fdopen(fildes, "w+e");
   }
 
   /* Use standard tmpfile (delete on close); tmp dir is undefined: */
