Applying hotfixes to ColdFusion 9 and earlier? A guide to getting it right

Note: This blog post is from 2014. Some content may be outdated--though not necessarily. Same with links and subsequent comments from myself or others. Corrections are welcome, in the comments. And I may revise the content as necessary.

Of course, in CF10 it's easier now because of the built-in "server updates" feature of the CF Admin. But in earlier releases, it was all on you to both keep up on the updates and to apply them manually. And a lot of people either never bothered, or may have tried and failed, or did it but got it wrong.

What you need to know

So in this blog entry, I some key info that will help you, if you may be in need of applying one or more of those updates to CF9 and earlier. Indeed, I'll point to some past entries I've done where I shared a lot more detail that I find is vital and rarely mentioned when some people try to share just the bare minimum of info (often leaving people hanging).

For instance, I'll help you answer such questions as what hotfixes do you already have applied? How do you find out? And you need to know exactly what version of CF you have, whether 9.0/9.0.1/9.0.2, 8.0/8.0.1, 7.0/7.0.1/7.0.2, and so on. I'll explain how to tell and why that's important, and especially when it comes to finding and applying hotfixes. And if you have applied hotfixes, are you sure you have done it right? It's easy to get things wrong and botch things. I'll help you avoid several very common mistakes.

(That's why it's so great that CF10 finally handles things for us. But this entry, focused on 9 and earlier, is not the place to discuss concerns with the CF10 hotfix mechanism. If you have questions or concerns about that, see the substantial CF10 Hotfix Installation Guide from Adobe, a 50-question FAQ on all things related to that feature.)

I'll also point you to where to find hotfixes and installers for CF9 and earlier (not as easy as it may seem), and still more.

If any of that's of interest, and I hope it is if you're on CF9 or earlier, then read on.

Checking versions, hotfixes applied

So first, if you want to know what version you have (9.0, 9.0.1, or 9.0.2) and what updates you have, see my 2012 entry, How to tell what, if any, hotfixes have been applied to #ColdFusion".

Getting/applying hotfixes correctly

And if you may decide to proceed with some update(s), do proceed with caution. I share some warnings here, from 2011: CF911: Are you finding CF (or CF Admin) busted after applying a hotfix? A few possible reasons. Even though that's now from 3 years ago, much of the info is still very relevant and important for people applying hotfixes to CF9 or earlier for the first time today. (In fact, I have still more I want to share, in terms of specific steps to follow to ensure successful updating, based on those warnings, which I plan to do in a future entry.)

Note as well that if you think that downloading an installer from Adobe should mean it has all the updates already applied, that's not so, as I discussed in 2010 in CFMyths: "When I download CF to install it from scratch, it has the latest fixes/updaters".

Beware, too, that some people apply the wrong hotfixes for their release. I discussed that in a 2009 entry, You may have mistakenly applied an 8.0 CHF on a 8.0.1 CF server, and not realize it!. Again, while it was written for CF8 it's just as relevant for CF9 (or 7, etc.).

Where to find CF9 hotfixes

If you may wonder how to find available CF9 hotfixes, I provide links to them in that cf myths blog entry.

Do I need only apply the latest CHF and no more after that?

Along the same lines as the last entry, note as well that there may be some surprises for you if you assuming that you need only apply the latest CHF (cumulative hotfix). There were some instances in the past where, even after applying the latest CHF, there were some "manual updates" listed for earlier CHFs that still need to be applied. This was especially so for CF8, as I discussed that same day in 2010 in CFMyths: "If/when I apply Cumulative Hotfixes, I need apply only the latest CHF, right?".

Beyond that, even in CF9, the latest CHF would include all the hotfixes up to that point, but it would ALSO include *security updates*. Unfortunately, there were still more security updates after that. You can find them here.

I also discuss some important matters about CF security hotfixes and their potential impact on your applications here.

Should you just move to 9.0.2? Some things to know

Finally, moving far forward in time, if you may be tempted to go to the latest release of CF 9, 9.0.2, there is some very important info you should be aware of, which I discuss in this 2013 entry, Understanding the 9.0.2 release of #ColdFusion, a FAQ for those who missed the news last year.

Hope that's helpful. I may do some more retrospective entries like this, gathering up the breadcrumbs I've dropped over he years. I realize that most people will not typically go browsing through a blog looking for old entries. I do, on the sites of others, but I'm crazy that way. (That said, it's how I often learn great tips that others have shared. Don't knock it till you've tried it. You can troll back in time here by following either the categories or the calendar on the right.)

For more content like this from Charlie Arehart:

• Signup to get his blog posts by email:
• Follow his blog RSS feed
• View the rest of his blog posts
• View his blog posts on the Adobe CF portal

Need more help with problems?

• If you may prefer direct help, rather than digging around here/elsewhere or via comments, he can help via his online consulting services
• See that page for more on how he can help a) over the web, safely and securely, b) usually very quickly, c) teaching you along the way, and d) with satisfaction guaranteed