Secunia

A vulnerability has been reported in Sophos Anti-Virus, which can be exploited by malicious people to conduct script insertion attacks.

The vulnerability is caused due to an input validation error when logging the results of a detected malware in an archive with a specially crafted filename. This can be exploited to insert arbitrary HTML and script code, which will be executed when printing the resulting logfile.

The vulnerability is reported in versions 6.x and 7.0.0.

Solution
Update to versions 6.5.8 or later, or 7.0.1 or later.
Further details available in Customer Area

Provided and/or discovered by
Michael Jordon, Context Information Security Ltd

Original Advisory
http://www.sophos.com/support/knowledgebase/article/29150.html

Deep Links
Links available in Customer Area