On 04/08/14 10:39, Uwe Rothmeier wrote: > Any hint how to put that statement in 4.80? I am not so familiar with
> exim and do not want to compile from source.
It's not a compilation issue.
$domain is data supplied by a potential attacker.
Using it to form a filename without validating it
is dangerous.
If that coding is actually in Debian exim4-daemon-heavy
you should raise a bug with Debian.
Are you certain you're not using an earlier-version
config file?
--
Jeremy
