VMware Security Advisory – Updated Tomcat and Java JRE packages have been made available for VMWare ESX 3.5. It is not a few updates either. Check out how many CVEs are covered. Judging by the CVE age, their turn around time on patching is quite sad.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/67400/VMSA-2008-00010.txt
Source: https://packetstormsecurity.com/files/67400/VMware-Security-Advisory-2008-00010.html