* SECURITY FIX: Restrict a report's CrashDB field to literals.
Use ast.literal_eval() instead of the generic eval(), to prevent arbitrary
code execution from malicious .crash files. A user could be tricked into
opening a crash file whose CrashDB field contains an exec(), open(), or
similar commands; this is fairly easy as we install a MIME handler for
these. Thanks to Donncha O'Cearbhaill for discovering this!
(CVE-2016-9949, LP: #1648806)
* SECURITY FIX: Fix path traversal vulnerability with hooks execution.
Ensure that Package: and SourcePackage: fields loaded from reports do not
contain directories. Until now, an attacker could trick a user into opening a
malicious .crash file containing
Package: ../../../../some/dir/foo
which would execute /some...