--- libxerces2-java-2.9.1.orig/debian/libxerces2-java.links
+++ libxerces2-java-2.9.1/debian/libxerces2-java.links
@@ -0,0 +1,2 @@
+/usr/share/java/jaxp-1.3.jar /usr/share/java/xmlParserAPIs.jar
+/usr/share/java/jaxp-1.3.jar /usr/share/maven-repo/xerces/xmlParserAPIs/2.6.2/xmlParserAPIs-2.6.2.jar
--- libxerces2-java-2.9.1.orig/debian/libxerces2-java-doc.examples
+++ libxerces2-java-2.9.1/debian/libxerces2-java-doc.examples
@@ -0,0 +1,3 @@
+build/samples/*
+build/xercesSamples.jar
+
--- libxerces2-java-2.9.1.orig/debian/pom.xml
+++ libxerces2-java-2.9.1/debian/pom.xml
@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project
+ xmlns="http://maven.apache.org/POM/4.0.0"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+
+ <modelVersion>4.0.0</modelVersion>
+ <parent>
+ <groupId>org.apache</groupId>
+ <artifactId>apache</artifactId>
+ <version>4</version>
+ </parent>
+ <groupId>xerces</groupId>
+ <artifactId>xercesImpl</artifactId>
+ <version>2.9.1</version>
+ <name>Xerces2 Java Parser</name>
+ <description>
+ Xerces2 is the next generation of high performance, fully compliant XML parsers in the
+ Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI),
+ a complete framework for building parser components and configurations that is extremely
+ modular and easy to program.
+ </description>
+ <url>http://xerces.apache.org/xerces2-j</url>
+
+ <dependencies>
+ <dependency>
+ <groupId>xml-apis</groupId>
+ <artifactId>xml-apis</artifactId>
+ <version>1.3.04</version>
+ </dependency>
+ <dependency>
+ <groupId>xml-resolver</groupId>
+ <artifactId>xml-resolver</artifactId>
+ <version>1.2</version>
+ <optional>true</optional>
+ </dependency>
+ </dependencies>
+
+
+ <build>
+ <sourceDirectory>src</sourceDirectory>
+ </build>
+
+</project>
\ No newline at end of file
--- libxerces2-java-2.9.1.orig/debian/ant.properties
+++ libxerces2-java-2.9.1/debian/ant.properties
@@ -0,0 +1,4 @@
+jar.apis=jaxp-1.3.jar
+jar.resolver=xml-commons-resolver-1.1.jar
+tools.dir=/usr/share/java
+
--- libxerces2-java-2.9.1.orig/debian/libxerces2-java.docs
+++ libxerces2-java-2.9.1/debian/libxerces2-java.docs
@@ -0,0 +1,6 @@
+NOTICE
+NOTICE.resolver.txt
+NOTICE.serializer.txt
+README
+Readme.html
+
--- libxerces2-java-2.9.1.orig/debian/changelog
+++ libxerces2-java-2.9.1/debian/changelog
@@ -0,0 +1,247 @@
+libxerces2-java (2.9.1-4.1) unstable; urgency=high
+
+ * Non-maintainer upload by the Security Team.
+ * Fixed CVE-2009-2625: denial of service (infinite loop and application hang)
+ via malformed XML input (Closes: #548358)
+
+ -- Giuseppe Iuculano <iuculano@debian.org> Fri, 29 Jan 2010 11:19:09 +0100
+
+libxerces2-java (2.9.1-4) unstable; urgency=low
+
+ * Upload to unstable.
+
+ -- Torsten Werner <twerner@debian.org> Sun, 09 Aug 2009 12:48:51 +0200
+
+libxerces2-java (2.9.1-3) experimental; urgency=low
+
+ * Change section to java, bump up Standards-Version to 3.8.1
+ * Bump up debhelper to 6
+ * Add the Maven POM to the package,
+ * Add a Build-Depends dependency on maven-repo-helper
+ * Use mh_installpom and mh_installjar to install the POM and the jar to the
+ Maven repository
+ * Add ${misc:Depends} to Depends to clear Lintian warnings
+ * Remove full text of the Apache 2 license from copyright
+
+ [Matthias Klose]
+ * Set java source and target version to 1.4. LP: #264808.
+ * Depend on default-jre-headless.
+
+ -- Ludovic Claude <ludovic.claude@laposte.net> Thu, 07 May 2009 20:44:34 +0100
+
+libxerces2-java (2.9.1-2) unstable; urgency=low
+
+ * Build-Depends on default-jdk-builddep. Closes: #477892
+
+ -- Michael Koch <konqueror@gmx.de> Sun, 27 Apr 2008 06:37:01 -0100
+
+libxerces2-java (2.9.1-1) unstable; urgency=low
+
+ * New upstream version.
+ * Updated Standards-Version to 3.7.3.
+ * Added myself to Uploaders.
+ * Added Vcs-Svn and Vcs-Browser fields.
+
+ -- Michael Koch <konqueror@gmx.de> Mon, 31 Dec 2007 11:02:34 +0100
+
+libxerces2-java (2.9.0-1) unstable; urgency=low
+
+ * New upstream.
+ * debian/control: removed Stefan Gybas and Wolfgang Baer from uploaders.
+ * debian/rule: added generation of the documentation (merge
+ libxerces2-java-doc).
+
+ -- Arnaud Vandyck <avdyk@debian.org> Tue, 3 Jul 2007 20:21:12 +0200
+
+libxerces2-java (2.8.1-2) unstable; urgency=low
+
+ [Arnaud Vandyck]
+ * debian/watch: added
+
+ [Matthias Klose]
+ * Merge from Ubuntu:
+ - Build architecture dependent -gcj package.
+ - Move build-indep dependencies to build dependencies.
+ - Add gij as alternative runtime dependency.
+
+ -- Matthias Klose <doko@debian.org> Wed, 3 Jan 2007 13:27:26 +0100
+
+libxerces2-java (2.8.1-1) unstable; urgency=low
+
+ * New upstream version.
+ * Add dependency on libjaxp1.3-java. (Closes: #394221)
+ * Correct copyright information.
+
+ -- Marcus Better <marcus@better.se> Sun, 22 Oct 2006 21:39:07 +0200
+
+libxerces2-java (2.8.0-1) unstable; urgency=low
+
+ * upload to unstable.
+
+ -- Arnaud Vandyck <avdyk@debian.org> Mon, 3 Jul 2006 11:29:15 +0000
+
+libxerces2-java (2.8.0-0) experimental; urgency=low
+
+ * New upstream release.
+ * Built with gcj
+ * Updated to Standards-Version 3.7.2: cdbs and debhelper to
+ Build-Depends
+ * Removed jikes compiler definition
+
+ -- Arnaud Vandyck <avdyk@debian.org> Mon, 3 Jul 2006 13:27:27 +0200
+
+libxerces2-java (2.6.2-4) unstable; urgency=low
+
+ * gnujaxp transition
+
+ -- Wolfgang Baer <WBaer@gmx.de> Tue, 17 Jan 2006 21:50:14 +0100
+
+libxerces2-java (2.6.2-3) unstable; urgency=low
+
+ * libant1.6-java to ant transition
+ * As we now have ant >= 1.6.3 we can drop the dom2 source hack
+ + Remove dom2 source from debian package
+ + Added bootclasspath patch to the javac target
+ * Standards-Version 3.6.2 (no changes)
+
+ -- Wolfgang Baer <WBaer@gmx.de> Sun, 25 Sep 2005 02:02:36 +0200
+
+libxerces2-java (2.6.2-2) unstable; urgency=medium
+
+ * Included DOM Level 2 sources from the libjaxp1.2-java
+ source package to built against them (closes: #304524)
+ Note: This is a temporary solution - after sarge we will update
+ ant which includes bootclasspath support for jikes need to build
+ without included sources.
+ * Included README.dom2-sources explaining where the DOM Level 2 sources
+ come from, why they are needed ...
+ * Included build.xml patch to copy the DOM Level 2 sources from the
+ debian directory - before the build - to the build directory.
+ * Changed Build-Depends to Build-Depends-Indep to fix lintian warning.
+ * (avdyk) Added Wolfgang to the uploaders.
+
+ -- Wolfgang Baer <WBaer@gmx.de> Tue, 19 Apr 2005 20:28:25 +0200
+
+libxerces2-java (2.6.2-1) unstable; urgency=low
+
+ * New upstream release
+ * Build with free-java-sdk / SableVM instead of Kaffe so I don't need the
+ ugly LD_LIBRARY_PATH hack any longer (closes: #246468)
+ * Use libgnujaxp-java instead of libxerces-java to call Ant since it's
+ included by the SableVM wrapper automatically. It's a bit strange to use
+ an external XML parser to build an XML parser but such is life...
+ * Change the classpath dependency to classpath-common
+
+ -- Stefan Gybas <sgybas@debian.org> Sun, 6 Jun 2004 18:00:26 +0200
+
+libxerces2-java (2.6.1-1) unstable; urgency=low
+
+ * New upstream release
+ * Split the libxerces2-java source package into libxerces2-java (main)
+ and libxerces2-java-doc (contrib). The package in main now builds the
+ library package, the one in contrib the documentation. Building the
+ documentation requires JDK 1.4 and other packages from contrib. The split
+ also avoids circular build dependencies with Xalan-J.
+ * Use Kaffe, Jikes and Ant 1.6 to build the package
+ * Use the new libjaxp1.2-java and libxml-commons-resolver1.1-java packages
+ * Updated the package description and README.Debian
+
+ -- Stefan Gybas <sgybas@debian.org> Wed, 18 Feb 2004 14:17:24 +0100
+
+libxerces2-java (2.6.0-1) unstable; urgency=low
+
+ * New upstream release
+ * Depend on "classpath | java1-runtime | java2-runtime"
+ * Updated download location and copyright years in debian/copyright
+ * Move xercesSamples.jar from libxerces2-java to the examples in
+ libxerces2-java-doc
+ * Don't install versioned JARs in /usr/share/java. Sorry, I'm unable to
+ determine an API version. This version is fully compatible to version
+ 2.5.*, 2.4.* and others. Should I create 5 symlinks for each JAR to
+ prevent other packages that use the versioned JAR from breaking?
+
+ -- Stefan Gybas <sgybas@debian.org> Tue, 13 Jan 2004 22:15:43 +0100
+
+libxerces2-java (2.5.0-1) unstable; urgency=low
+
+ * New upstream release (closes: #206185)
+ * Renamed to source package to libxerces2-java
+ * Set maintainer to Debian Java Maintainers
+ * Mention XML Inclusions (XInclude) in the long description
+ * Standards-Version: 3.6.1
+ + Changed Build-Depends-Indep to Build-Depends
+
+ -- Stefan Gybas <sgybas@debian.org> Fri, 17 Oct 2003 15:22:07 +0200
+
+xerces2-j (2.4.0-1) unstable; urgency=low
+
+ * New upstream release
+ * Built using Blackdown's JDK 1.4 instead of the converted RPM from Sun
+ * Standards-Version: 3.5.9 (no changes required)
+
+ -- Stefan Gybas <sgybas@debian.org> Sun, 13 Apr 2003 18:50:54 +0200
+
+xerces2-j (2.3.0-1) unstable; urgency=low
+
+ * New upstream release
+ + Fixes the DTD parsing problems in Tomcat 4 (closes: #167135, #171929)
+ * Build with the latest Jikes version (>= 1.18)
+ * Include the compiled examples (xercesSamples.jar) (closes: #170822)
+ * Enable experimental DOM Level 3 support and updated the package
+ description about the new XML 1.1 features
+
+ -- Stefan Gybas <sgybas@debian.org> Mon, 10 Feb 2003 19:54:06 +0100
+
+xerces2-j (2.2.1-1) unstable; urgency=low
+
+ * New upstream release
+ * Added versioned build dependency on jikes
+ * Compile the classes with debugging enabled
+ * Standards-Version: 3.5.8 (no changes required)
+
+ -- Stefan Gybas <sgybas@debian.org> Mon, 18 Nov 2002 15:10:27 +0100
+
+xerces2-j (2.2.0-1) unstable; urgency=low
+
+ * New upstream release
+ * Added Takashi Okamoto and Ola Lundqvist as uploaders
+ * Use jikes to compile the Java classes
+
+ -- Stefan Gybas <sgybas@debian.org> Wed, 23 Oct 2002 18:23:15 +0200
+
+xerces2-j (2.1.0-1) unstable; urgency=low
+
+ * New upstream release
+ * Updated package description
+ * Build with latest Ant and Xalan-J versions
+ * Fixed some typos in README.Debian
+ * Build with debhelper >= 4.1.0 to get rid of /usr/doc compatibility
+ symlinks
+ * Standards-Version: 3.5.7
+
+ -- Stefan Gybas <sgybas@debian.org> Mon, 2 Sep 2002 15:35:13 +0200
+
+xerces2-j (2.0.2-1) unstable; urgency=low
+
+ * New upstream release
+ * Build with j2sdk >= 1.4.0 because it supports -Djava.awt.headless=true
+ for Xalan and so an X11 display is not needed during the build
+ * Use debhelper V4
+ * Updated README.Debian and package description
+
+ -- Stefan Gybas <sgybas@debian.org> Mon, 1 Jul 2002 20:44:04 +0200
+
+xerces2-j (2.0.1-1) unstable; urgency=low
+
+ * New upstream release (closes: #140832)
+ * The package can now be built with j2sdk1.3 1.3.1-1 or later
+
+ -- Stefan Gybas <sgybas@debian.org> Wed, 3 Apr 2002 21:05:23 +0200
+
+xerces2-j (2.0.0-1) unstable; urgency=low
+
+ * Initial release
+ * Placed in contrib because it requires Ant and a Java2 environment
+ to build
+
+ -- Stefan Gybas <sgybas@debian.org> Thu, 7 Feb 2002 16:37:15 +0100
--- libxerces2-java-2.9.1.orig/debian/README.Debian
+++ libxerces2-java-2.9.1/debian/README.Debian
@@ -0,0 +1,11 @@
+Xerces2-J for Debian
+====================
+
+- Unlike Xerces-J 1.x (Debian package libxerces-java) this package contains
+ two JARs in /usr/share/java/ which both need to be in your class path:
+ * xercesImpl.jar contains the actual Xerces parser
+ * xmlParserAPIs.jar contains the XML APIs (DOM, SAX) which are used by
+ all standard XML parsers. This is a symbolic link to jaxp-1.3.jar from
+ the libjaxp1.3-java package.
+
+ -- Marcus Better <marcus@better.se>, Sun, 22 Oct 2006 21:42:14 +0200
--- libxerces2-java-2.9.1.orig/debian/control
+++ libxerces2-java-2.9.1/debian/control
@@ -0,0 +1,61 @@
+Source: libxerces2-java
+Section: java
+Priority: optional
+Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
+Uploaders: Arnaud Vandyck <avdyk@debian.org>, Marcus Better <marcus@better.se>, Matthias Klose <doko@ubuntu.com>, Michael Koch <konqueror@gmx.de>
+Build-Depends: cdbs (>= 0.4.8), debhelper (>= 6), default-jdk-builddep, ant,
+ maven-repo-helper, libxml-commons-resolver1.1-java, libjaxp1.3-java, libstylebook-java
+Standards-Version: 3.8.1
+Vcs-Svn: svn://svn.debian.org/svn/pkg-java/trunk/libxerces2-java
+Vcs-Browser: http://svn.debian.org/wsvn/pkg-java/trunk/libxerces2-java
+Homepage: http://xerces.apache.org/xerces2-j/
+
+Package: libxerces2-java
+Architecture: all
+Depends: ${misc:Depends}, default-jre-headless | java1-runtime-headless | java2-runtime-headless, libjaxp1.3-java
+Recommends: libxerces2-java-gcj
+Suggests: libxerces2-java-doc
+Description: Validating XML parser for Java with DOM level 3 support
+ The Xerces2 Java parser is the reference implementation of XNI, the
+ Xerces Native Interface, and also a fully conforming XML Schema processor.
+ .
+ Xerces2-J supports the following standards and APIs:
+ * eXtensible Markup Language (XML) 1.0 Second Edition Recommendation
+ * Namespaces in XML Recommendation
+ * Document Object Model (DOM) Level 2 Core, Events, and Traversal and
+ Range Recommendations
+ * Simple API for XML (SAX) 2.0.1 Core and Extension
+ * Java APIs for XML Processing (JAXP) 1.2.01
+ * XML Schema 1.0 Structures and Datatypes Recommendations
+ * Experimental implementation of the Document Object Model (DOM) Level 3
+ Core and Load/Save Working Drafts
+ * Provides a partial implementation of the XML Inclusions (XInclude) W3C
+ Candidate Recommendation
+ .
+ Xerces is now able to parse documents written according to the XML 1.1
+ Candidate Recommendation, except that it does not yet provide an option to
+ enable normalization checking as described in section 2.13 of this
+ specification. It also handles namespaces according to the XML Namespaces 1.1
+ Candidate Recommendation, and will correctly serialize XML 1.1 documents if
+ the DOM level 3 load/save API's are in use.
+
+Package: libxerces2-java-gcj
+Architecture: any
+Depends: libxerces2-java (>= ${source:Version}), libjaxp1.3-java-gcj, ${misc:Depends}, ${shlibs:Depends}
+Description: Validating XML parser for Java with DOM level 3 support (native code)
+ The Xerces2 Java parser is the reference implementation of XNI, the
+ Xerces Native Interface, and also a fully conforming XML Schema processor.
+ .
+ This package contains the natively compiled code for use by gij.
+
+Package: libxerces2-java-doc
+Architecture: all
+Section: doc
+Depends: ${misc:Depends}
+Suggests: libxerces2-java, doc-html-w3
+Description: Validating XML parser for Java -- Documentation and examples
+ The Xerces2 Java parser is the reference implementation of XNI, the
+ Xerces Native Interface, and also a fully conforming XML Schema processor.
+ .
+ This package contains the documentation in HTML format, the Javadoc API
+ documentation and some examples.
--- libxerces2-java-2.9.1.orig/debian/copyright
+++ libxerces2-java-2.9.1/debian/copyright
@@ -0,0 +1,71 @@
+This package was debianized by Stefan Gybas <sgybas@debian.org> on 07-Feb-2002.
+
+The source was downloaded from <http://xerces.apache.org/xerces2-j/>.
+
+It is currently maintained by the Debian Java Maintainers
+<pkg-java-maintainers@lists.alioth.debian.org>.
+
+Copyright (C) 1999-2006 The Apache Software Foundation.
+Copyright (C) 2000-2001 World Wide Web Consortium.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+The full text of the license can be found in
+'/usr/share/common-licenses/Apache-2.0'.
+
+Parts of Xerces2 are covered by the following license:
+
+ W3C® SOFTWARE NOTICE AND LICENSE
+ http://www.w3.org/Consortium/Legal/2002/copyright-software-20021231
+
+ This work (and included software, documentation such as READMEs, or
+ other related items) is being provided by the copyright holders under
+ the following license. By obtaining, using and/or copying this work,
+ you (the licensee) agree that you have read, understood, and will
+ comply with the following terms and conditions.
+
+ Permission to copy, modify, and distribute this software and its
+ documentation, with or without modification, for any purpose and
+ without fee or royalty is hereby granted, provided that you include
+ the following on ALL copies of the software and documentation or
+ portions thereof, including modifications:
+
+ 1. The full text of this NOTICE in a location viewable to users of
+ the redistributed or derivative work.
+
+ 2. Any pre-existing intellectual property disclaimers, notices, or
+ terms and conditions. If none exist, the W3C Software Short
+ Notice should be included (hypertext is preferred, text is
+ permitted) within the body of any redistributed or derivative
+ code.
+
+ 3. Notice of any changes or modifications to the files, including
+ the date changes were made. (We recommend you provide URIs to the
+ location from which the code is derived.)
+
+ THIS SOFTWARE AND DOCUMENTATION IS PROVIDED "AS IS," AND COPYRIGHT
+ HOLDERS MAKE NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED,
+ INCLUDING BUT NOT LIMITED TO, WARRANTIES OF MERCHANTABILITY OR FITNESS
+ FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF THE SOFTWARE OR
+ DOCUMENTATION WILL NOT INFRINGE ANY THIRD PARTY PATENTS, COPYRIGHTS,
+ TRADEMARKS OR OTHER RIGHTS.
+
+ COPYRIGHT HOLDERS WILL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, SPECIAL
+ OR CONSEQUENTIAL DAMAGES ARISING OUT OF ANY USE OF THE SOFTWARE OR
+ DOCUMENTATION.
+
+ The name and trademarks of copyright holders may NOT be used in
+ advertising or publicity pertaining to the software without specific,
+ written prior permission. Title to copyright in this software and any
+ associated documentation will at all times remain with copyright
+ holders.
--- libxerces2-java-2.9.1.orig/debian/rules
+++ libxerces2-java-2.9.1/debian/rules
@@ -0,0 +1,54 @@
+#!/usr/bin/make -f
+# debian/rules file for libxerces2-java (uses cdbs)
+
+# Uncomment this to turn on verbose mode.
+export DH_VERBOSE=1
+
+include /usr/share/cdbs/1/rules/debhelper.mk
+include /usr/share/cdbs/1/rules/simple-patchsys.mk
+include /usr/share/cdbs/1/class/ant.mk
+
+PACKAGE := $(DEB_SOURCE_PACKAGE)
+VERSION := $(DEB_UPSTREAM_VERSION)
+JAVA_HOME := /usr/lib/jvm/default-java
+ANT_HOME := /usr/share/ant
+ANT_OPTS = -Dant.build.javac.source=1.4 -Dant.build.javac.target=1.4
+
+include /usr/share/gcj/debian_defaults
+ifneq (,$(filter $(DEB_HOST_ARCH), $(gcj_native_archs)))
+ with_gcj_native := yes
+endif
+
+# Additional JARs to add to the class path, either full path or just the
+# basename for JARs in /usr/share/java. The ".jar" suffix may also be ommitted
+DEB_JARS := xml-commons-resolver-1.1
+#jaxp-1.3.jar stylebook
+
+# Ant targets to call
+DEB_ANT_CLEAN_TARGET := clean
+DEB_ANT_BUILD_TARGET := jar sampjar javadocs
+#docs
+
+install/$(PACKAGE)::
+ mh_installpoms -p$(PACKAGE);
+ mh_installjar -p$(PACKAGE) -l debian/pom.xml $(DEB_BUILDDIR)/build/xercesImpl.jar
+
+ifeq ($(with_gcj_native),yes)
+install/libxerces2-java-gcj:: install/libxerces2-java
+ dh_nativejava -plibxerces2-java-gcj
+endif
+
+clean::
+ rm -rf build
+ -rm -rf debian/tmp
+
+binary-post-install/libxerces2-java-doc::
+ dh_install -plibxerces2-java-doc build/docs/javadocs/* \
+ usr/share/doc/libxerces2-java-doc/api
+
+get-orig-source:
+ -uscan --download-version $(DEB_UPSTREAM_VERSION) --force-download --rename --repack
+
+get-orig-pom:
+ wget -O debian/pom.xml http://repository.sonatype.org/service/local/repositories/central/content/xerces/xercesImpl/$(VERSION)/xercesImpl-$(VERSION).pom
+
--- libxerces2-java-2.9.1.orig/debian/watch
+++ libxerces2-java-2.9.1/debian/watch
@@ -0,0 +1,2 @@
+version=3
+http://www.apache.org/dist/xml/xerces-j/source/ Xerces-J-src\.([\d+\.]+|\d+)\.tar\.gz debian uupdate
--- libxerces2-java-2.9.1.orig/debian/compat
+++ libxerces2-java-2.9.1/debian/compat
@@ -0,0 +1 @@
+6
--- libxerces2-java-2.9.1.orig/debian/libxerces2-java.poms
+++ libxerces2-java-2.9.1/debian/libxerces2-java.poms
@@ -0,0 +1,2 @@
+debian/pom.xml --no-parent
+
--- libxerces2-java-2.9.1.orig/debian/patches/03_bootclasspath.patch
+++ libxerces2-java-2.9.1/debian/patches/03_bootclasspath.patch
@@ -0,0 +1,12 @@
+--- build.xml.orig 2005-09-25 02:22:43.000000000 +0200
++++ build.xml 2005-09-25 02:18:57.000000000 +0200
+@@ -228,7 +228,8 @@
+ deprecation="${deprecation}"
+ optimize="${optimize}"
+ includeAntRuntime="false"
+- includeJavaRuntime="false"
++ includeJavaRuntime="true"
++ bootclasspath="/usr/share/java/jaxp-1.3.jar"
+ excludes="org/xml/sax/**
+ javax/xml/parsers/**
+ org/w3c/dom/*
--- libxerces2-java-2.9.1.orig/debian/patches/01_xjavac_taskdef.patch
+++ libxerces2-java-2.9.1/debian/patches/01_xjavac_taskdef.patch
@@ -0,0 +1,11 @@
+--- build.xml~ 2006-03-01 01:14:50.000000000 +0000
++++ build.xml 2006-07-03 09:58:48.000000000 +0000
+@@ -28,7 +28,7 @@
+ <property name="tools.dir" value="./tools"/>
+
+ <!-- enable compilation under JDK 1.4 and above -->
+- <taskdef name="xjavac" classname="org.apache.xerces.util.XJavac">
++ <taskdef name="xjavac" classname="org.apache.tools.ant.taskdefs.Javac">
+ <classpath>
+ <pathelement location="${tools.dir}/bin/xjavac.jar"/>
+ </classpath>
--- libxerces2-java-2.9.1.orig/debian/patches/04_CVE-2009-2625.patch
+++ libxerces2-java-2.9.1/debian/patches/04_CVE-2009-2625.patch
@@ -0,0 +1,20 @@
+CVE-2009-2625
+diff --git a/src/org/apache/xerces/impl/XMLScanner.java b/src/org/apache/xerces/impl/XMLScanner.java
+index a64ce11..1abca0e 100644
+--- a/src/org/apache/xerces/impl/XMLScanner.java
++++ b/src/org/apache/xerces/impl/XMLScanner.java
+@@ -1027,6 +1027,14 @@ public abstract class XMLScanner
+ if (XMLChar.isMarkup(c) || c == ']') {
+ fStringBuffer.append((char)fEntityScanner.scanChar());
+ }
++ else if (XMLChar.isHighSurrogate(c)) {
++ scanSurrogates(fStringBuffer);
++ }
++ else if (isInvalidLiteral(c)) {
++ reportFatalError("InvalidCharInSystemID",
++ new Object[] { Integer.toHexString(c) });
++ fEntityScanner.scanChar();
++ }
+ } while (fEntityScanner.scanLiteral(quote, ident) != quote);
+ fStringBuffer.append(ident);
+ ident = fStringBuffer;
--- libxerces2-java-2.9.1.orig/debian/patches/02_build_dont_unzip.patch
+++ libxerces2-java-2.9.1/debian/patches/02_build_dont_unzip.patch
@@ -0,0 +1,18 @@
+--- build.xml.orig 2004-01-30 16:42:54.000000000 +0100
++++ build.xml 2004-02-18 13:40:34.000000000 +0100
+@@ -191,6 +191,7 @@
+ </copy>
+
+ <!-- now deal with API's: -->
++ <!-- not neede for Debian, use the classes in /usr/share/java/jaxp-1.3.jar
+ <unzip src="${src.apis.zip}" dest="${build.src}">
+ <patternset
+ includes="org/xml/sax/**
+@@ -202,6 +203,7 @@
+ org/w3c/dom/traversal/**"
+ />
+ </unzip>
++ -->
+
+ <!-- substitute tokens as needed -->
+ <replace file="${build.dir}/src/org/apache/xerces/impl/Version.java"
![[patchlogo]](http://patch-tracker.debian.org/static/img/swirlpatch.png)