a/xz-5.6.1-x86_64-2.txz: Rebuilt.
       Seems like a good idea to build this from a git pull rather than the signed
       release tarballs. :-)
       The liblzma in the previous packages were not found to be vulnerable by the
       detection script, but I'd rather not carry the bad m4 files in our sources.
       Here's a test script for anyone wanting to try it:
       if hexdump -ve '1/1 "%.2x"' /lib*/liblzma.so.5 | grep -q f30f1efa554889f54c89ce5389fb81e7000000804883ec28488954241848894c2410 ; then
       echo probably vulnerable
       else
       echo probably not vulnerable
       fi

Вот вам код для проверки от Патрика.