Sophos Anti-Virus 3.78 allows remote attackers to bypass virus scanning by using a qmail generated Delivery Status Notification (DSN) where the original email is not included in the bounce message.
https://exchange.xforce.ibmcloud.com/vulnerabilities/15192
http://www.sophos.com/support/news/#mime-378
http://www.securityfocus.com/bid/9650