CVE-2018-11796

In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit
for XML parsing. However, Tika reuses SAXParsers and calls reset() after
each parse, which, for Xerces2 parsers, as per the documentation, removes
the user-specified SecurityManager and thus removes entity expansion limits
after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore
still vulnerable to entity expansions which can lead to a denial of service
attack. Users should upgrade to 1.19.1 or later.