Debian Security Advisory 1873-1 - Juan Pablo Lopez Yacubian discovered that incorrect handling of invalid URLs could be used for spoofing the location bar and the SSL certificate status of a web page.
356bf7c18df73523e6398c09fcd86214240a2f6d1b8b04047695a2254b6e4857