Debian 11: DLA-3920-1 high: php7.4 code execution risks

CVE-2022-4900

It was discovered that setting the environment variable
PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer
overflow.

CVE-2024-5458

Due to a code logic error, filtering functions such as filter_var
when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs
the function results in invalid user information (username +
password part of URLs) being treated as valid user information.
This may lead to the downstream code accepting invalid URLs as valid
and parsing them incorrectly.

This causes the same problems as CVE-2020-7071, but with IPv6 host
parts.

CVE-2024-8925

Mihail Kirov discovered an erroneous parsing of multipart form data
contained in an HTTP POST request, which could lead to legitimate
data not being processed thereby violating data integrity.

CVE-2024-8927

It was discovered that the `cgi.force_redirect` configuration
setting is bypassable due to environment variable collision.

CVE-2024-9026