CVE-2024-58249: 
Linux Debian vulnerability analysis and mitigation

In wxWidgets before version 3.2.7, a vulnerability was discovered where applications could crash when connections are refused in wxWebRequestCURL. The issue was identified and tracked as CVE-2024-58249, with a CVSS v3.1 base score of 3.7 (LOW) (NVD).

The vulnerability stems from a use-after-free condition in the handling of socket connections within wxWebRequestCURL. Specifically, when connections are refused, the application attempts to delete a wxEventLoopSourceHandler that may still be in use, particularly when receiving write IO notifications just before an error notification. This can lead to a crash when processing subsequent error notifications (GitHub Commit).

When exploited, this vulnerability results in application crashes when attempting to handle refused connections in wxWidgets applications that use wxWebRequestCURL. The impact is primarily limited to availability issues, with no known confidentiality or integrity impacts (NVD).

The vulnerability can be triggered when connections are refused in wxWebRequestCURL, particularly when attempting to connect to non-existent or non-responding network services. This has been demonstrated with various connection scenarios, including attempts to connect to non-existing ports and localhost connections (GitHub Issue).

The issue has been fixed in wxWidgets version 3.2.7. The fix involves implementing a mechanism to avoid deleting handlers for which write notification is being processed, and instead deleting them later when receiving error notifications (GitHub Commit).