Two vulnerabilities have been reported in Sophos Anti-Virus, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.

1) An input validation error when processing UPX-compressed executables can be exploited to write one byte to an arbitrary location.

Successful exploitation may allow execution of arbitrary code.

2) An error when processing BZIP archives can be exploited to cause an infinite loop and e.g cause all the available disk space to be used for the engine's temporary files.

The vulnerabilities are reported in Sophos Anti-Virus with engine versions prior to 2.48.0.

Solution
Update to engine version 2.48.0 or later.

Provided and/or discovered by
Sergio Alvarez, n.runs AG

Changelog
Further details available in Customer Area

Original Advisory
Sophos:
http://www.sophos.com/support/knowledgebase/article/28407.html

n.runs AG:
http://www.nruns.com/security_advisory_sophos_upx_code_execution.php
http://www.nruns.com/security_advisory_sophos_gzip_infinite_loop_dos.php

Deep Links
Links available in Customer Area