Security disclosures in Inetutils, croc, Info-ZIP, and IXP Manager

Several security issues were disclosed on oss-security, covering a buffer overflow, path traversal chainable to code execution, command injection, and authenticated privilege escalation. Some reports include CVE assignments or fixes in current releases.

GNU Inetutils talkd buffer overflow

Collin Funk disclosed a buffer overflow in GNU Inetutils talkd triggered by long reverse DNS replies. CVE-2026-19720 has been assigned. Operators running talkd should assess risk from untrusted DNS responses.

Path traversal in croc fixed in 11.0.3

An oss-security post details path traversal in croc via received filenames, fixed in version 11.0.3. The issue enables arbitrary file deletion that can chain to remote code execution on the receiver. Users of the file transfer tool should update to the patched release.

Info-ZIP test option command injection

An initial oss-security disclosure reports command injection in the Info-ZIP -T option through crafted filenames. Processing a malicious archive can result in arbitrary command execution. Packagers and users of Info-ZIP should review the report for mitigation steps.

IDOR and mass assignment in IXP Manager

A first report describes an authenticated IDOR and BOLA flaw with mass assignment in IXP Manager API key updates. The issue allows overwriting other users API keys, including superuser keys, enabling privilege escalation. Operators of IXP Manager should restrict API key management pending a fix.