Fix available here. Versions previous to v4.4 contain local root buffer overflow vulnerabilities. Fix available here. Not setuid by default, but often installed setuid. Passwords are stored in plain text.
Denial of service is possible.
Tested on Slackware 7.1 and Redhat 6.2. Overflows the -display command line option. Tested on Slackware. Tested against Red Hat 7, SuSe 6.x, and Debian.