VMware ESXi update addresses several security issues.
ESX 5.0 without patch ESXi500-201207101-SG
ESXi 4.1 without patch ESXi410-201208101-SG
ESXi 4.0 without patch ESXi400-201209401-SG
a. ESXi update to third party component libxml2
The libxml2 third party library has been updated which addresses multiple security issues.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-4008, CVE-2011-0216,CVE-2011-1944, CVE-2011-2834, CVE-2011-3905,CVE-2011-3919 and CVE-2012-0841 to these issues.
* hosted products are VMware Workstation, Player, ACE, Fusion.
Note: "patch pending" means that the product is affected, but no patch is currently available. The advisory will be updated when a patch is available.
Please review the patch/release notes for your product and version and verify the checksum of your downloaded file.
ESXi500-201207001 contains ESXi500-201207101-SG
http://kb.vmware.com/kb/2020373 update-from-esxi4.1-4.1_update03 contains ESXi410-201208101-SG
ESXi400-201209001 contains ESXi400-201209401-SG
2012-07-12 VMSA-2012-0012 Initial security advisory in conjunction with the release of a patch for ESXi 5.0 on 2012-07-12.
2012-08-30 VMSA-2012-0012.1 Updated Relevant Releases, Problem Description, and Solution sections to include information regarding updates for ESXi in conjunction with the release of vSphere 4.1 U3 on 2012-08-30.
2012-09-13 VMSA-2012-0012.2 Updated security advisory in conjunction with the release of vSphere 4.0 U4a on 2012-09-12 and ESX 4.0 patches on 2012-09-13. Removed CVE-2010-4494 and CVE-2011-2821 since these CVEs are not relevant to ESXi.
E-mail list for product security notifications and announcements:
This Security Advisory is posted to the following lists:
E-mail: security at vmware.com
PGP key at:
VMware Security Advisories
VMware security response policy
General support life cycle policy
VMware Infrastructure support life cycle policy
Copyright 2012 VMware Inc. All rights reserved.