patched XML vulnerability