VMWare issues 'critical' ESXi security advisory

According to this VMWare advisory, the patches fix two remote buffer overflows in the handling of HTTP basic authentication headers.

• This vulnerability could potentially be exploited by users without valid login credentials.

The vulnerability exists in the "Openwsman" system management platform which is enabled by default in ESX to implement the Web Services Management protocol (WS-Management).