XML External Entity (XXE) Injection

itextpdf is vulnerable to XML external entity XXE injection attacks. These attacks are possible because the library does not disable external entities when parsing pdf files...