It was discovered that the processreport() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.
Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function pythonmodulepath.