VMware Security Advisory - Updated Tomcat and Java JRE packages have been made available for VMWare ESX 3.5. It is not a few updates either. Check out how many CVEs are covered. Judging by the CVE age, their turn around time on patching is quite sad.
bdca972198318dc99cbe922fcffca76537d29df7f9248d8962802a8c0051113f