Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code. NOTE: as of 20060410 it is unclear whether this is a vulnerability as there is some evidence that the arguments are actually being sanitized properly.