diff --git a/gnu/packages/patchutils.scm b/gnu/packages/patchutils.scm
index 48f4d295848ad916d4df71f6a6afa12abd2d17a2..3dbf72435ebff037062dacdccf47f1ae2e702acf 100644
--- a/gnu/packages/patchutils.scm
+++ b/gnu/packages/patchutils.scm
@@ -96,7 +96,7 @@ (define-public quilt
     (build-system gnu-build-system)
     (inputs `(("perl" ,perl)
               ("less" ,less)
-              ("file" ,file)
+              ("file" ,file-5.20)                 ;work around CVE-2014-3710
               ("ed" ,ed)))
     (arguments
      '(#:parallel-tests? #f
diff --git a/gnu/packages/version-control.scm b/gnu/packages/version-control.scm
index 0b52f0c2e52e4de302d407f61e1d5b1b8503e066..931297cf2adc1ce1b420eb9983a4e5059b9ea0f6 100644
--- a/gnu/packages/version-control.scm
+++ b/gnu/packages/version-control.scm
@@ -507,7 +507,7 @@ (define-public aegis
     (inputs
      `(("e2fsprogs" ,e2fsprogs)
        ("curl" ,curl)
-       ("file" ,file)
+       ("file" ,file-5.20)                        ;work around CVE-2014-3710
        ("libxml2" ,libxml2)
        ("zlib" ,zlib)
        ("gettext" ,gnu-gettext)))