VMware has acknowledged multiple vulnerabilities in VMware ESX Server, which can be exploited by malicious, local users to disclose potentially sensitive information, by malicious users to cause a DoS (Denial of Service), and by malicious people to disclose potentially sensitive information, manipulate certain data, bypass certain security restrictions, conduct spoofing attacks, conduct DNS cache poisoning attacks, cause a DoS (Denial of Service), and compromise a vulnerable system.

1) An error exists in the bundled version of the OpenSSL library.

For more information:
SA42473

2) An error exists in the bundled version of the libuser library.

For more information:
SA42891

3) Two errors exist in the bundled version of the NSS library.

For more information see vulnerabilities #7 and #10:
SA41244

4) Multiple vulnerabilities exist in the bundled version of Sun Java JRE.

For more information:
SA39762
SA41791
SA43262
SA44784

5) An integer overflow error exists in the bundled version of sblim-sfcb.

For more information:
SA40018

The vulnerabilities are reported in versions 3.5, 4.0, and 4.1.

Solution
Apply patches (please see the vendor's advisory for details).
Changelog
Further details available to Secunia VIM customers

Original Advisory
VMware (VMSA-2011-0013, VMSA-2012-0003, VMSA-2012-0006):
http://www.vmware.com/security/advisories/VMSA-2011-0013.html
http://www.vmware.com/security/advisories/VMSA-2012-0003.html
http://www.vmware.com/security/advisories/VMSA-2012-0006.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers