[ksherlock]

"It is used by a fairly large number of other programs, one of which is OpenSSH. "

Not exactly. OpenSSH does not use xz. From the original report:

"openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma."

[db48x]

True but irrelevant. I left out a lot of irrelevant details, because I was aiming for a simple explanation (if not quite one truly suited for a five–year–old).