Check your version of liblzma:

dpkg -l |grep liblzma

If you are not on something with APT, you should be able to check just by running:

xz --version

Think it's 5.6.* that has the vulnerability