VMware has released several patches that address vulnerabilities in older ESX and ESXi versions. These patches should be installed as soon as possible to preserve the security of VMware installations.
<ul>
	<li>ESX 3.5-4.1 and ESXi 3.5-4.1 should install available patches to address a ROM Overwrite vulnerability that allows privilege escalation in Windows 2000 through 2003 R2 guests (<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1515">CVE-2012-1515</a>).</li>
	<li>ESX 4.0 should install available patches to update the service console to kernel-400.2.6.18-238.4.11.591731 and fix multiple inherited vulnerabilities (
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2482" target="_new">CVE-2011-2482</a>, <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3191" target="_new">CVE-2011-3191</a>, and <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4348" target="_new">CVE-2011-4348</a>). The patch for ESXi 4.1 is still pending.</li>
	<li>ESX 4.0 should install available updates to patch Kerberos vulnerabilities (<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4862">CVE-2011-4862</a>).</li>
</ul>
As always, the easiest way to patch your VMware hosts is with VMware <a href="http://www.vmware.com/products/update-manager/overview.html">vSphere Update Manager</a>. Update Manager, combined with VMware vMotion, lets you safely patch your critical virtual hosts without maintenance windows, service interruptions, or costly downtime.

You can <a href="http://lists.vmware.com/mailman/listinfo/security-announce">sign up for email notifications</a> of new security advisories, which are also published on the <a href="http://www.vmware.com/security/advisories">VMware website</a>.