We have found that the tcsh shell had a problem with very long pathnames. When a very long path was encountered tcsh failed to check the result of getcwd() in all places, which could be exploited.
We recommend you upgrade your tcsh package immediately.