vmware-server-1.0.9, build 156507 was released March 31st, 2009. Many fixes, one of the more important is a fix for CVE-2009-1244: New: Host code execution vulnerability from a guest operating system A critical vulnerability in the virtual machine display function might allow a guest operating system to run code on the host. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2009-1244 to this issue.
Somehow I missed bug 265139 in previous searches. Marking as duplicate. *** This bug has been marked as a duplicate of bug 265139 ***