The AMaViS virus scanner 0.2.0-pre4 and earlier allows remote attackers to execute arbitrary commands as root via an infected mail message with shell metacharacters in the reply-to field.
https://exchange.xforce.ibmcloud.com/vulnerabilities/2349
http://www.securityfocus.com/bid/527