--- a/jaxp/src/com/sun/org/apache/xalan/internal/utils/ObjectFactory.java	Wed Jul 05 18:46:58 2017 +0200
+++ b/jaxp/src/com/sun/org/apache/xalan/internal/utils/ObjectFactory.java	Mon Feb 18 11:33:35 2013 -0800
@@ -54,6 +54,8 @@
     //
     // Constants
     //
+     private static final String XALAN_INTERNAL = "com.sun.org.apache.xalan.internal";
+     private static final String XERCES_INTERNAL = "com.sun.org.apache.xerces.internal";
 
     // name of default properties file to look for in JDK's jre/lib directory
     private static final String DEFAULT_PROPERTIES_FILENAME =
@@ -514,12 +516,17 @@
         //class. Restrict the access to the package classes as specified in java.security policy.
         SecurityManager security = System.getSecurityManager();
         try{
-                if (security != null){
+            if (security != null){
+                if (className.startsWith(XALAN_INTERNAL) ||
+                    className.startsWith(XERCES_INTERNAL)) {
+                    cl = null;
+                } else {
                     final int lastDot = className.lastIndexOf(".");
                     String packageName = className;
                     if (lastDot != -1) packageName = className.substring(0, lastDot);
                     security.checkPackageAccess(packageName);
-                 }
+                }
+             }
         }catch(SecurityException e){
             throw e;
         }