Gentoo Linux Security Advisory 201604-2 – Insufficient constraints in Apache’s Xalan-Java might allow remote attackers to execute arbitrary code and load arbitrary classes. Versions less than 2.7.2 are affected.