...
A secondary task for older installations is to unendorse the Xerces and Xalan libraries from your container, remove the libraries (optionally)from their endorsed location, and lastly, modify the internal.xml file as described in the advisory. The latter change is not optional, and will guarantee that the Oracle-supplied parser is used. The IdP will fail to load if this change is not done, and conversely, the IdP will also fail to load if the file is changed but the endorsement is not undone.
...