Linley Henzell : Security Vulnerabilities, CVEs,

crawl before 4.0.0 does not securely call programs when saving and loading games, which allows local users to gain privileges.

crawl before 4.0.0 beta23 does not properly "apply a size check" when copying a certain environment variable, which may allow local users to gain privileges, possibly as a result of a buffer overflow.