Patch XML parsing vulnerability