Some vulnerabilities have been reported in VMware ESX and ESXi, which can be exploited by malicious, local users to gain escalated privileges.

1) A vulnerability in the CPU hardware emulation can be exploited by malicious, local users to gain escalated privileges.

For more information:
SA32612

This vulnerability is reported in VMware ESX 2.5.4, 2.5.5, 3.0.2, 3.0.3, 3.5, and ESXi 3.5.

2) An unspecified input validation error can be exploited by administrators to gain escalated privileges via directory traversal attacks.

Successful exploitation requires that an administrator has the "Datastore.FileManagement" privilege.

This vulnerability is reported in VMware ESX 3.5 and ESXi 3.5.

Solution
Update to the latest version or apply patches.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits:
1) Derek Soeder
2) Michel Toussaint

Original Advisory
VMSA-2008-0018:
http://lists.vmware.com/pipermail/security-announce/2008/000042.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area