Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I saw the new secruity hotfix for ColdFusion on, but I'm unsure what is already installed. The version in ColdFusion Administrator is 8,0,1,195765.

How can I tell which ColdFusion hotfixes are installed?

Can I attempt to install a Cumulative hotfix without a problem?

share|improve this question

If I remember correctly, ColdFusion hotfixes consist of a simple "replace some files".

To verify the installation status of a hotfix, there likely isn't any way other than to verify those files directly.

Installation of a cumulative hotfix should be safe regardless of current hotfix levels.

share|improve this answer

As Shane said, most have been just replacing files. In some cases there are additional JARs added. On a CF9 install they're in /opt/coldfusion9/lib/updates/ but I think that location is the same for CF8.

You could also look at this which uses something called hashdeep and a pre-generated hash file to determine if your CFIDE matches the patched version.

share|improve this answer

On both ColdFusion 8 and 9 hotfixes are installed to the {coldfusion-install}/lib/updates directory. Hotfixes are identified in the directory as hfvvv-xxxxx.jar where vvv is the version of ColdFusion and xxxxx is a bugid for a specific fix. Security hotfixes follow the same convention but the xxxxx is a sequential number. The last security hotfix for ColdFusion 8.0.1 (APSB12-21) is hf801-00007.jar.

Cumulative hotfixes are located in the same directory but are identified by chfvvvxxxx.jar, again where vvv is the version of ColdFusion and xxxx is a sequential number. The last Cumulative Hotfix for ColdFusion 8.0.1 is chf8010004.jar.

If you need an easy way to make sure your ColdFusion 8.0.1 or 9.0.x server is patched correctly, I'd recommend using Unofficial Updater 2

While what Ian linked to will be able to tell you if the contents of the CFIDE directory are correctly patched, there are files in other directories, particularly on ColdFusion 8.0.1 that need to be updated to be fully patched.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.