diff -r cc682329886b -r b0610cd08440 src/share/jaxws_classes/com/sun/tools/internal/xjc/reader/xmlschema/parser/SchemaConstraintChecker.java
--- a/src/share/jaxws_classes/com/sun/tools/internal/xjc/reader/xmlschema/parser/SchemaConstraintChecker.java	Thu Sep 26 10:43:28 2013 -0700
+++ b/src/share/jaxws_classes/com/sun/tools/internal/xjc/reader/xmlschema/parser/SchemaConstraintChecker.java	Fri Oct 04 16:21:34 2013 +0100
@@ -69,6 +69,7 @@
         boolean hadErrors = false;
 
         SchemaFactory sf = XmlFactory.createSchemaFactory(W3C_XML_SCHEMA_NS_URI, disableXmlSecurity);
+        XmlFactory.allowExternalAccess(sf, "all", disableXmlSecurity);
         sf.setErrorHandler(errorFilter);
         if( entityResolver != null ) {
             sf.setResourceResolver(new LSResourceResolver() {
@@ -91,6 +92,7 @@
         }
 
         try {
+            XmlFactory.allowExternalDTDAccess(sf, "all", disableXmlSecurity);
             sf.newSchema(getSchemaSource(schemas, entityResolver));
         } catch (SAXException e) {
             // TODO: we haven't thrown exceptions from here before. should we just trap them and return false?