In the patch for 7053556, the ObjectFactory/SecuritySupport classes that were duplicated in many packages were replaced by a unified set under internal/utils. When the jaxp 1.4.5 source bundle was dropped however, it was a copy of the source bundle on top of the original source, therefore leaving these classes behind unremoved. The result was that these classes were used in the repository. They should be removed.