VMware patches third-party components in vSphere platform

VCenter Server and ESXi patches update the bundled versions of Apache Struts, Apache Tomcat, glibc and JRE

VMware has updated third-party libraries and components used by its vSphere server virtualization platform to integrate security patches released in recent months.

The company released vCenter Server 5.5 Update 2 in order to include a patch for a remote code execution vulnerability in the Apache Struts Web framework used inside the product.

The same vCenter Server release updates the Apache Tomcat component to version 7.0.52, originally released in February, which includes fixes for two denial-of-service and one information disclosure vulnerabilities.

VCenter Server 5.5 Update 2 and vCenter Update Manager 5.5 Update 2 change the bundled Java Runtime Environment (JRE) version to 1.7 Update 55 that was released in April. This Java version contains patches for 37 security vulnerabilities.

The VMware vSphere Hypervisor (ESXi) received a patch called ESXi550-201409101-SG that updates the included GNU C Library (glibc) in order to address two buffer overflow vulnerabilities that can trigger denial-of-service conditions.

Updates and patches are pending for vCenter Server and ESXi 5.1 and 5.0, the company said in a security advisory.

Security researchers have repeatedly warned in the past that because many software projects use third-party libraries, vulnerabilities identified and patched in those components can linger on in some programs for months and even years. VMware is one of the software makers that do catch up with third-party code patches periodically, but not all of them do.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags patchessecuritypatch managementVMware

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles


GGG Evaluation Team

Kathy Cassidy


First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni


For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell


The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi


The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott


My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?