An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that
1:1.27.2-2ubuntu3.41:1.30.1-4ubuntu6.41:1.30.1-7ubuntu2Exploitability
AV:LAC:HPR:LUI:NScope
S:UImpact
C:LI:NA:HCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H