VMware ESX Server and VMware VirtualCenter Multiple Vulnerabilities

Multiple vulnerabilities have been identified in various VMWare products, which could be exploited by remote attackers to bypass security restrictions or compromise a vulnerable system, or by local attackers to disclose sensitive information or gain elevated privileges, cause a denial of service or take complete control of an affected system.

1. Due to an error in VMware CPU hardware emulation could allow the virtual CPU to jump to an incorrect memory address, leading to a privilege escalation on 64-bit guest operating systems.

2. Due to user passwords containing special characters are displayed when logging into VirtualCenter Server 2.0 with Virtual Infrastructure Client 2.5, which could cause the dialog box displaying the password to appear in front or hidden behind other windows.

3. Due to an unspecified error in the Java Management Extensions (JMX) management agent, which may allow a JMX client running on a remote host to perform unauthorized operations on a system running JMX with local monitoring enabled.

4. Due to an unspecified error in the Java Runtime Environment, which may allow an untrusted applet that is loaded from a remote system to circumvent network access restrictions and establish socket connections to certain services running on the local host.

5. Due to errors related to the processing of XML data, which could allow unauthorized access to certain URL resources.

6. Due to an error in the Java Runtime Environment Virtual Machine, which may allow an untrusted application or applet that is downloaded from a website to elevate its privileges.

7. Due to a buffer overflow error within the processing of fonts in the Java Runtime Environment (JRE), which may allow an untrusted applet or application to elevate its privileges.

8. Due to errors in the Java Runtime Environment relating to scripting language support, which may allow an untrusted applet or application to elevate its privileges or to access information from another applet.

9. Due to buffer overflow errors in Java Web Start, which may allow an untrusted Java Web Start application to elevate its privileges.

10. Due to an error in Java Web Start, which may allow an untrusted application downloaded from a website to create or delete arbitrary files with the permissions of the user running the untrusted Java Web Start application.

11. Due to an error in Java Web Start, which may allow an untrusted Java Web Start application to determine the location of the Java Web Start cache.

12. Due to an error in the JDK/JRE Secure Static Versioning feature, which could cause applets to run on an older JRE/JDK release installed on the system.