I saw the new secruity hotfix for ColdFusion on adobe.com, but I'm unsure what is already installed. The version in ColdFusion Administrator is 8,0,1,195765.

How can I tell which ColdFusion hotfixes are installed?

Can I attempt to install a Cumulative hotfix without a problem?


If I remember correctly, ColdFusion hotfixes consist of a simple "replace some files".

To verify the installation status of a hotfix, there likely isn't any way other than to verify those files directly.

Installation of a cumulative hotfix should be safe regardless of current hotfix levels.


On both ColdFusion 8 and 9 hotfixes are installed to the {coldfusion-install}/lib/updates directory. Hotfixes are identified in the directory as hfvvv-xxxxx.jar where vvv is the version of ColdFusion and xxxxx is a bugid for a specific fix. Security hotfixes follow the same convention but the xxxxx is a sequential number. The last security hotfix for ColdFusion 8.0.1 (APSB12-21) is hf801-00007.jar.

Cumulative hotfixes are located in the same directory but are identified by chfvvvxxxx.jar, again where vvv is the version of ColdFusion and xxxx is a sequential number. The last Cumulative Hotfix for ColdFusion 8.0.1 is chf8010004.jar.

If you need an easy way to make sure your ColdFusion 8.0.1 or 9.0.x server is patched correctly, I'd recommend using Unofficial Updater 2

While what Ian linked to will be able to tell you if the contents of the CFIDE directory are correctly patched, there are files in other directories, particularly on ColdFusion 8.0.1 that need to be updated to be fully patched.


As Shane said, most have been just replacing files. In some cases there are additional JARs added. On a CF9 install they're in /opt/coldfusion9/lib/updates/ but I think that location is the same for CF8.

You could also look at this http://www.dcepler.net/post.cfm/file-integrity-checking-cfide which uses something called hashdeep and a pre-generated hash file to determine if your CFIDE matches the patched version.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.