backport upstream fix for CVE-2013-4002

CVE-2013-4002 xerces-j2: Xerces-J2 OpenJDK: XML parsing Denial of Service
6.3.x https://bugzilla.redhat.com/show_bug.cgi?id=1140004
6.4 https://bugzilla.redhat.com/show_bug.cgi?id=1140005