Aggregator

NDSS 2025 – Translating C To Rust: Lessons From A User Study

Security Boulevard
1 month 2 weeks ago

Session 13D: Software Security: Code and Compiler

Authors, Creators & Presenters: Ruishi Li (National University of Singapore), Bo Wang (National University of Singapore), Tianyu Li (National University of Singapore), Prateek Saxena (National University of Singapore), Ashish Kundu (Cisco Research)

PAPER
Translating C To Rust: Lessons From A User Study

Rust aims to offer full memory safety for programs, a guarantee that untamed C programs do not enjoy. How difficult is it to translate existing C code to Rust? To get a complementary view from that of automatic C to Rust translators, we report on a user study asking humans to translate real-world C programs to Rust. Our participants are able to produce safe Rust translations, whereas state-of-the-art automatic tools are not able to do so. Our analysis highlights that the high-level strategy taken by users departs significantly from those of automatic tools we study. We also find that users often choose zero-cost (static) abstractions for temporal safety, which addresses a predominant component of runtime costs in other full memory safety defenses. User-provided translations showcase a rich landscape of specialized strategies to translate the same C program in different ways to safe Rust, which future automatic translators can consider.

ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.

Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.

Permalink

The post NDSS 2025 – Translating C To Rust: Lessons From A User Study appeared first on Security Boulevard.

Marc Handelman

ResidentBat Android Malware Provides Belarusian KGB with Persistent Access to Mobile Devices

Cyber Security News
1 month 2 weeks ago

A newly documented Android spyware called ResidentBat has been linked to the Belarusian KGB, giving state operators deep and persistent access to the mobile devices of journalists and civil society members. First publicly reported in December 2025 through a joint investigation by Reporters Without Borders (RSF) and RESIDENT.NGO, the malware’s code history suggests it was quietly developed […]

The post ResidentBat Android Malware Provides Belarusian KGB with Persistent Access to Mobile Devices appeared first on Cyber Security News.

Tushar Subhra Dutta

CVE-2026-3275 | Tenda F453 1.0.0.3 httpd /goform/addressNat fromAddressNat entrys buffer overflow

VulDB Recent Entries
1 month 2 weeks ago
A vulnerability classified as critical was found in Tenda F453 1.0.0.3. This affects the function fromAddressNat of the file /goform/addressNat of the component httpd. Executing a manipulation of the argument entrys can lead to buffer overflow. This vulnerability appears as CVE-2026-3275. The attack may be performed from remote. In addition, an exploit is available.
vuldb.com

CVE-2026-3274 | Tenda F453 1.0.0.3 httpd /goform/L7Prot frmL7ProtForm page buffer overflow

VulDB Recent Entries
1 month 2 weeks ago
A vulnerability classified as critical has been found in Tenda F453 1.0.0.3. Affected by this issue is the function frmL7ProtForm of the file /goform/L7Prot of the component httpd. Performing a manipulation of the argument page results in buffer overflow. This vulnerability is reported as CVE-2026-3274. The attack is possible to be carried out remotely. Moreover, an exploit is present.
vuldb.com

CVE-2026-3273 | Tenda F453 1.0.0.3 httpd /goform/AdvSetWrlsafeset formWrlsafeset mit_ssid_index buffer overflow

VulDB Recent Entries
1 month 2 weeks ago
A vulnerability described as critical has been identified in Tenda F453 1.0.0.3. Affected by this vulnerability is the function formWrlsafeset of the file /goform/AdvSetWrlsafeset of the component httpd. Such manipulation of the argument mit_ssid_index leads to buffer overflow. This vulnerability is documented as CVE-2026-3273. The attack can be executed remotely. Additionally, an exploit exists.
vuldb.com

CVE-2026-3272 | Tenda F453 1.0.0.3 httpd /goform/DhcpListClient fromDhcpListClient page buffer overflow

VulDB Recent Entries
1 month 2 weeks ago
A vulnerability marked as critical has been reported in Tenda F453 1.0.0.3. Affected is the function fromDhcpListClient of the file /goform/DhcpListClient of the component httpd. This manipulation of the argument page causes buffer overflow. This vulnerability is registered as CVE-2026-3272. Remote exploitation of the attack is possible. Furthermore, an exploit is available.
vuldb.com

CVE-2026-3271 | Tenda F453 1.0.0.3 httpd /goform/P2pListFilterof fromP2pListFilter page buffer overflow

VulDB Recent Entries
1 month 2 weeks ago
A vulnerability labeled as critical has been found in Tenda F453 1.0.0.3. This impacts the function fromP2pListFilter of the file /goform/P2pListFilterof of the component httpd. The manipulation of the argument page results in buffer overflow. This vulnerability is cataloged as CVE-2026-3271. The attack may be launched remotely. Furthermore, there is an exploit available.
vuldb.com

CVE-2026-3270 | psi-probe PSI Probe up to 5.3.0 Whois Whois.java lookup server-side request forgery

VulDB Recent Entries
1 month 2 weeks ago
A vulnerability identified as critical has been detected in psi-probe PSI Probe up to 5.3.0. This affects the function lookup of the file psi-probe-core/src/main/java/psiprobe/tools/Whois.java of the component Whois. The manipulation leads to server-side request forgery. This vulnerability is listed as CVE-2026-3270. The attack may be initiated remotely. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

CVE-2026-3269 | psi-probe PSI Probe up to 5.3.0 Session ExpireSessionsController.java handleRequestInternal denial of service

VulDB Recent Entries
1 month 2 weeks ago
A vulnerability categorized as problematic has been discovered in psi-probe PSI Probe up to 5.3.0. The impacted element is the function handleRequestInternal of the file psi-probe-core/src/main/java/psiprobe/controllers/sessions/ExpireSessionsController.java of the component Session Handler. Executing a manipulation can lead to denial of service. This vulnerability is tracked as CVE-2026-3269. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

CVE-2026-3268 | psi-probe PSI Probe up to 5.3.0 Session Attribute RemoveSessAttributeController.java access control (EUVD-2026-8926)

VulDB Recent Entries
1 month 2 weeks ago
A vulnerability was found in psi-probe PSI Probe up to 5.3.0. It has been rated as critical. The affected element is an unknown function of the file psi-probe-core/src/main/java/psiprobe/controllers/sessions/RemoveSessAttributeController.java of the component Session Attribute Handler. Performing a manipulation results in improper access controls. This vulnerability is identified as CVE-2026-3268. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

UAT-10027 Targets U.S. Education and Healthcare with Dohdoor Backdoor

The Hackers News
1 month 2 weeks ago
A previously undocumented threat activity cluster has been attributed to an ongoing malicious campaign targeting education and healthcare sectors in the U.S. since at least December 2025. The campaign is being tracked by Cisco Talos under the moniker UAT-10027. The end goal of the attacks is to deliver a never-before-seen backdoor codenamed Dohdoor. "Dohdoor utilizes the DNS-over-HTTPS (DoH)
The Hacker News

Managed ad