Add FAQ on libexpat and security

diff --git a/doc/FAQ.html b/doc/FAQ.html
index f13611868a9c8e35774552d3894b13279cafc28f..a412d06dbb92f5b30810b19b161ff2c545d831e1 100644 (file)
--- a/doc/FAQ.html
+++ b/doc/FAQ.html
@@ -695,7 +695,7 @@ The default DOTFONTPATH is:
 </pre>
 If your fonts are somewhere else, then you must set that directory in
 the webdot script, or recompile Graphviz with the correct DEFAULT_FONTPATH
-(or set <tt>fontpath="/your/font/directory" in every graph you lay out,
+(or set <tt>fontpath="/your/font/directory"</tt> in every graph you lay out,
 but that's pretty clumsy.)
 <P>
 Q. <B> My browser doesn't recognize SVG.</B>
@@ -712,5 +712,11 @@ renderer in Java and can be run as a stand-alone program.
 <P>
 For help with embedding SVG in HTML pages, see 
 <A HREF="http://www.graphviz.org/webdot/svgembed.html">here</A>.
+Q. <B> libexpat is reported as containing a virus or as a security hole.
+Is this a real problem?
+<P>
+No, this is a false positive reported by various security software.
+See <A HREF=http://www.pcreview.co.uk/forums/thread-1689630.php>http://www.pcreview.co.uk/forums/thread-1689630.php</A> or
+<A HREF=http://spywareblog.com/index.php/2004/11/24/is_libexpat_dll_spyware>http://spywareblog.com/index.php/2004/11/24/is_libexpat_dll_spyware</A>.
 </BODY>
 </HTML>