VMware has released several patches that address vulnerabilities in older ESX and ESXi versions. These patches should be installed as soon as possible to preserve the security of VMware installations.
<ul>
	<li>ESX 3.5-4.1 and ESXi 3.5-4.1 should install available patches to address a ROM Overwrite vulnerability that allows privilege escalation in Windows 2000 through 2003 R2 guests (<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1515">CVE-2012-1515</a>).</li>
	<li>ESX 4.0 should install available patches to update the service console to kernel-400.2.6.18-238.4.11.591731 and fix multiple inherited vulnerabilities (
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2482" target="_new">CVE-2011-2482</a>, <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3191" target="_new">CVE-2011-3191</a>, and <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4348" target="_new">CVE-2011-4348</a>). The patch for ESXi 4.1 is still pending.</li>
	<li>ESX 4.0 should install available updates to patch Kerberos vulnerabilities (<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4862">CVE-2011-4862</a>).</li>
</ul>
As always, the easiest way to patch your VMware hosts is with VMware's <a href="http://www.vmware.com/products/update-manager/overview.html">vSphere Update Manager</a>. Update Manager, combined with VMware vMotion, lets you safely patch your critical virtual hosts without maintenance windows, service interruptions, or costly downtime.

To be alerted of security advisories as they are released, you can <a href="http://lists.vmware.com/mailman/listinfo/security-announce">sign up for email notifications</a>. Advisories are also published on the <a href="http://www.vmware.com/security/advisories">VMware website</a>.