Vulnerability in xz version v0.5.6

[Niksko]

This version of xz is vulnerable to a denial of service and an infinite loop.

Your bz2 encoder seems to be the only one out there at the moment. This means that packages that need to do bz2 encoding (or test bz2 decoding) require this package eventually, which means this vulnerability is likely to cause headaches.

[dsnet]

Hi, thanks for the report. Did you mean to post this at github.com/ulikunitz/xz instead? This repository does not have an xz implementation.