CVE-2023-43618

CVE-2023-43618 affects Croc (≤9.6.5). The issue is that the protocol requires a sender to provide its local IP addresses in cleartext via an ips? message, exposing internal network identifiers. Several external sources (GHSA-7MP6-929P-PQHJ, OSV entries) corroborate that Croc transmits local IPs i...

CVE-2023-43617

CVE-2023-43617 affects Croc up to version 9.6.5. When a custom shared secret is used, parts of that secret may be divulged to an untrusted Relay as part of composing a room name. This is the disclosed root cause; no explicit mitigation or patch version is provided in the supplied documents. Other...

CVE-2023-43620

CVE-2023-43620 affects Croc (through 9.6.5): a sender can embed ANSI/CSI escape sequences in a filename to attack the receiver’s terminal device. The underlying issue is that filename handling naively processes escape sequences, enabling potential terminal manipulation. The connected OSV/GHSA ent...

CVE-2023-43619

CVE-2023-43619 affects Croc up to version 9.6.5. The issue allows a sender to deliver dangerous files to a receiver (e.g., executable content or a .ssh/authorized_keys file). Impact details: potential high severity with local access vector and user interaction required, as indicated by the CVSS 3...

CVE-2023-43621

CVE-2023-43621 affects Croc up to version 9.6.5. Affected condition: the shared secret is exposed on the command line and can be read by local users who list processes and their arguments. Reported across multiple sources (GHSA, OSV, NVD). Impact: local disclosure of the secret; no remote/externa...

CVE-2023-43616

CVE-2023-43616 affects Croc through version 9.6.5; a sender can cause the receiver to overwrite files during ZIP extraction due to the ZIP extraction handling. Impact is local and relates to file overwrites during extraction. The provided documents do not specify a fixed version or a remediation,...