VMware Security Announcements

Two of them this time around:

VMSA-2008-0019 (The website does not appear to have a 0019, but the 0018 matches up with it)

Updated VMware Hosted products and patches for ESX and ESXi resolve
two security issues. The first is a critical memory corruption
vulnerability in virtual device hardware. The second is an updated
bzip2 package for the Service Console

VMSA-2008-0017.2

Updated ESX packages for libxml2, ucd-snmp, libtiff.

A denial of service flaw was found in the way libxml2 processes
certain content. If an application that is linked against
libxml2 processes malformed XML content, the XML content might
cause the application to stop responding.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2008-3281 to this issue.

Additionally the following was also fixed, but was missing in the
security advisory.

A heap-based buffer overflow flaw was found in the way libxml2
handled long XML entity names. If an application linked against
libxml2 processed untrusted malformed XML content, it could cause
the application to crash or, possibly, execute arbitrary code.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2008-3529 to this issue.