Based on https://anonscm.debian.org/viewvc/pkg-java/trunk/libxerces2-java/debian/patches/03_bootclasspath.patch?revision=14509, adopted for guix

--- xerces-2_11_0/build.xml.orig	2010-11-26 21:42:11.000000000 +0100
+++ xerces-2_11_0/build.xml	2017-03-28 14:04:41.946606996 +0200
@@ -290,13 +290,14 @@
            destdir="${build.dest}"
            source="${javac.source}"
            target="${javac.target}"
-           classpath="${build.dir}/classes:${tools.dir}/${jar.apis}:${tools.dir}/${jar.resolver}:${tools.dir}/${jar.serializer}"
+           classpath="${build.dir}/classes:${jar.jaxp}:${jar.apis-ext}:${jar.resolver}"
            debug="${debug}" nowarn="true"
            debuglevel="${debuglevel}"
            deprecation="${deprecation}"
            optimize="${optimize}"
            includeAntRuntime="false"
-           includeJavaRuntime="false"
+           includeJavaRuntime="true"
+           bootclasspath="${jar.jaxp}:${jar.apis-ext}:${jar.resolver}"
            excludes="org/xml/sax/** 
                 javax/xml/**
                 org/w3c/dom/*
@@ -1451,13 +1452,14 @@
                destdir="${build.dest}"
                source="${javac.source}"
                target="${javac.target}"
-               classpath="${build.dir}/classes:${tools.dir}/${jar.apis}:${tools.dir}/${jar.resolver}:${tools.dir}/${jar.serializer}"
+               classpath="${build.dir}/classes:${jar.jaxp}:${jar.apis-ext}:${jar.resolver}"
                debug="${debug}"
                debuglevel="${debuglevel}"
                deprecation="${deprecation}"
                optimize="${optimize}"
                includeAntRuntime="false"
-               includeJavaRuntime="false"
+               includeJavaRuntime="true"
+               bootclasspath="${jar.jaxp}:${jar.apis-ext}:${jar.resolver}"
                excludes="org/xml/sax/** 
                     javax/xml/**
                     org/w3c/dom/*
 value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=7d26b017d89293822e30e899753fb3df4979c57f'>root</a>/<a href='/guix/log/gnu?id=7d26b017d89293822e30e899753fb3df4979c57f'>gnu</a>/<a href='/guix/log/gnu/packages?id=7d26b017d89293822e30e899753fb3df4979c57f'>packages</a>/<a href='/guix/log/gnu/packages/patches?id=7d26b017d89293822e30e899753fb3df4979c57f'>patches</a>/<a href='/guix/log/gnu/packages/patches/audiofile-fix-sign-conversion.patch?id=7d26b017d89293822e30e899753fb3df4979c57f'>audiofile-fix-sign-conversion.patch</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/packages/patches/audiofile-fix-sign-conversion.patch?id=7d26b017d89293822e30e899753fb3df4979c57f&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2019-12-26 16:44:53 +0100'>2019-12-26</span></td><td><a href='/guix/commit/gnu/packages/patches/audiofile-fix-sign-conversion.patch?id=a8e149434eb1500026256747b4ed21b8bab95926'>gnu: Add audiofile.</a><span class='msg-avail'>...<span class='msg-tooltip'>Patches should fix all CVEs reported by `guix lint`:
CVE-2015-7747; CVE-2017-6827, CVE-2017-6828, CVE-2017-6829,
CVE-2017-6830, CVE-2017-6831, CVE-2017-6832, CVE-2017-6833,
CVE-2017-6834, CVE-2017-6835, CVE-2017-6836, CVE-2017-6837,
CVE-2017-6838, CVE-2017-6839; CVE-2018-13440; CVE-2018-17095

Since the patches do not reference to CVEs, it's a bit hard to tell which
patch actually closes which CVE.  Debian reports all these to be closed by
the patches below and NixPkgs provides references.

* gnu/packages/audio.scm (audiofile): New variable.
* gnu/packages/patches/audiofile-fix-datatypes-in-tests.patch,
  gnu/packages/patches/audiofile-fix-sign-conversion.patch,
  gnu/packages/patches/audiofile-CVE-2015-7747.patch,
  gnu/packages/patches/audiofile-CVE-2018-13440.patch,
  gnu/packages/patches/audiofile-CVE-2018-17095.patch,
  gnu/packages/patches/audiofile-Check-the-number-of-coefficients.patch,
  gnu/packages/patches/audiofile-Fail-on-error-in-parseFormat.patch,
  gnu/packages/patches/audiofile-Fix-index-overflow-in-IMA.cpp.patch,
  gnu/packages/patches/audiofile-Fix-multiply-overflow-sfconvert.patch,
  gnu/packages/patches/audiofile-Fix-overflow-in-MSADPCM-decodeSam.patch,
  gnu/packages/patches/audiofile-division-by-zero-BlockCodec-runPull.patch,
  gnu/packages/patches/audiofile-hurd.patch,
  gnu/packages/patches/audiofile-signature-of-multiplyCheckOverflow.patch:
  New files.
* gnu/local.mk: Add them.
</span></span></td><td>Hartmut Goebel</td></tr>