Yikes. Tavis's paper shows multiple buffer overflow attacks against code in Sophos that scans executables and PDF files for viruses, so just by sending someone

Yikes. Tavis's paper shows multiple buffer overflow attacks against code in Sophos that scans executables and PDF files for viruses, so just by sending someone a file you can inject code into the virus checker, which has maximum privileges. It also disables address space randomization so exploitation is easy.