Past employers can say whatever they want. They open themselves up to legal liability in doing so, though, with basically no value to themselves. Theoretically as long as they're telling the truth, there is no legal liability. In reality it's more nuanced. e.g. An employer who reveals that a former employee was absent a lot might be sued successfully if the absence was within the company's sick day policy, or the reason was a disability.

Saying nothing is the safest choice. Most employers only confirm employment as a courtesy to their former employees.