An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that
"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2021-42374.json"