The following fixes are contained in ColdFusion 9.0.1 Cumulative Hot fix 2 (CHF2). Adobe recommends that you apply CHF2 to ColdFusion 9.0.1 only if you are experiencing one or more of the issues listed in the following table. This cumulative hot fix is specific to ColdFusion 9.0.1 and you should not to apply it to any other releases.
Note - Cumulative Hotfix 2 consists of previously released fixes for the Security issues mentioned in the bulletins APSB11-04, APSB11-14, APSB11-15 along with the cumulative hotfix 1 and the new bug fixes. This cumulative hot fix also has the new session invalid fix added to the Security hot fix.
| Bug ID | Description | Added in Cumulative Hot fix |
| APSB11-04 | Security fix for cross-site scripting, session fixation, CRLF injection and information disclosure. | 2 |
| APSB11-14 | Security fix for cross-site request forgery (CSRF) or a remote denial-of-service (DOS). | 2 |
| APSB11-15 | Security fix for unrestricted class creation during AMF/AMFX deserialization and complex object graph vulnerabilities. | 2 |
| 81110 | ColdFusion throws “org.apache.bcel.generic.ClassGenException: Invalid branch target position offset for goto” exception if there is a lot of code inside cfloop. | 2 |
| 83094 | ColdFusion throws ArrayIndexOutofBounds exception when cfstoredproc returns multiple result sets and application code uses duplicate function against the result set. | 2 |
| 83185 | CFFTP listDir action does not work with WFTPD ftp server. | 2 |
| 83316 | Cfexchangemail getAttachments action does not work with Outlook email messages attached to the email. All the .msg attachments are droped. Issue is fixed only for Exchange 2003. | 2 |
| 83425 | Cfcontent or Cfheader throws 404 error when the file size is larger than 300 MB. | 2 |
| 83447 | CFFile Upload action will not accept files of 2GB or greater regardless of value set for the “Maximum size of post data" in the administrator. | 2 |
| 83474 | ColdFusion ORM does not maintain the column order correctly when the CFC extends a base cfc with an attribute mappedSuperclass set to true. | 2 |
| 83514 | ColdFusion throws “java.lang.IllegalStateException: Session is invalid” exception randomly. | 2 |
| 83693 | ColdFusion throws an error during Solr indexing “org/apache/pdfbox/pdmodel/PDDocument null” whenever a file with .PDF extension is present in the path provided. | 2 |
| 83772 | Repeated runs of RandRange function when using SHAIPRNG causes function performance degradation. | 2 |
| 83980 | Intermittently cfmail tag does not set the MessageID correctly. | 2 |
| 84277 | Cfdocument tag does not honor the query param specified in the source url. | 2 |
| 84856 | Coldfusion does not honor gobal script protection if cfapplication tag is used and scriptprotection attribute is not set to true. | 2 |
| 84949 | ColdFusion throws variable ORGSPECDIR is undefined error when trying to register a remote instance with ColdFusion 9.0.1 | 2 |
| 85000 | The response header for a ColdFusion page always shows a content-length of 8192 irrespective of how much data is actually being served. | 2 |
| 85086 | cfquery tag throws an error if both ormoptions and datasource attributes are set. | 2 |
| 85099 | ColdFusion does not resolve the CFC’s fully qualified name correctly when a relative path is used in the application mapping. | 2 |
| 85232 | In a Custom tag, cftransaction rollback action does not work when clientstorage is configured with the database. | 2 |
| 86744 | Cfthread terminate action is not cleaning up the threads properly. | 2 |
| 86898 | SpreadsheetFormatColumn() function does not apply the date format correctly. | 2 |
| 86921 | When using IBM's Db2 connect JDBC driver with ColdFusion, it throws a Null Pointer exception when executing an insert or update on a DB2 mainframe database | 2 |
| 87015 | cfspreadsheet tag does not evaluate Excel’s percentile function. | 2 |
| APSB10-18 | Security Fix for the directory traversal vulnerability that could lead to information disclosure. | 1 |
| 83598 | Setting default locale to en_GB results in Invalid Date Format error when you run a scheduled task. | 1 |
| 83638 | serializeJSON converts integer to string. | 1 |
| 83650 | Submitting a form inside a cflayout type=”hbox|vbox” results in a JavaScript error. | 1 |
| 83671 | If named arguments with implicit structs and arrays use local variables, it results in ‘variable is undefined’ error. | 1 |
| 83689 | cfdump does not display the changes to the functions for a CFC object. | 1 |
| 83694 | cfgrid sorting does not function as desired for static and dynamic data except when the data is retrieved from the database. | 1 |
| 83725 | If you send mails with inline images, the source image is deleted. | 1 |
| 83747 | ColdFusion ORM preUpdate event handler is called twice when a persistent entity is updated within a cftransaction. Note: This issue has been fixed for one data source per request use-case. |
1 |
| 83818 | ColdFusion debugger can fail if the file being debugged is repeatedly revised. | 1 |
| 83829 | cfwindow onShow method is called twice. | 1 |
| 83836 | serializeJSON incorrectly serializes nested objects. Also, in the case of circular references, for example, when handling bidirectional ORM relationship, repeating entities are represented as empty strings instead of empty objects. | 1 |
Install ColdFusion 9.0.1 Cumulative Hotfix 2 (CHF2)
The installation process is the same for all platforms and installation choices. Follow the instructions below to apply the fix.
Definition of ColdFusion-Home
In the following procedures, {ColdFusion-Home} indicates the following:
• For Server installation: {ColdFusion-Home}
• For Multiserver installation: {JRun-Home}/servers/{YourServer}/cfusion-ear/cfusion-war/
• For J2EE installation: {cfusion-ear-Home}/cfusion-war/
Note: CFIDE.zip and WEB-INF.zip included in the hotfix contains only part of the CFIDE and WEB-INF files. Do not rename present CFIDE or WEB-INF folders to create a backup as per the instructions.
1. Download CF901.zip and CFIDE-901.zip. Extract CF901.zip. All the files are extracted to cf901 directory.
2. In the ColdFusion Administrator, select System Information page by clicking the "i" icon in the upper-right corner.
3. In the Update File text box, browse and select chf9010002.jar located under CF901/lib/updates directory.
4. Click Submit Changes.
5. Stop ColdFusion instance.
6. Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf901-00001.jar, hf901-00002.jar or chf9010001.jar exists, delete it. Please review all the bug numbers in this technote and if there are any single hotfixes present with the same bug numbers, delete them. Otherwise, ignore this step.
7. Go to {CFIDE-HOME} and make a backup of CFIDE folder.
8. Extract all files in CFIDE-901.zip to the web root directory that has {CFIDE-HOME} folder.
9. Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and make a backup of WEB-INF folder.
10. Go to cf901 directory and extract all the files in WEB-INF.zip to {ColdFusion-Home}/wwwroot (for Server installation) or {ColdFusion-Home} (for Multiserver and J2EE installations) directory.
11. Go to your {ColdFusion-Home}/lib (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib (for Multiserver and J2EE installations) directory. Make a backup of these files if present: commons-fileupload-1.2.jar, ESAPI.properties, esapi-2.0_rc10.jar, log4j.properties, validation.properties, flex-messaging-common.jar, flex-messaging-core.jar and jpedal.jar files.
12. Go to cf901/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib for Multiserver and J2EE installations) directory.
13. Start a ColdFusion instance.
14. If there are multiple instances, repeat steps 2 through13 for each of the instances.
After installation, you can delete the ColdFusion 9.0.1 cumulative hot fix JAR file. The file has been copied to the correct location.
The ColdFusion 9.0.1 cumulative hotfix JAR file appears as a new entry in the System Information list.
Uninstall Cumulative Hotfix 2
You can uninstall ColdFusion hotfix JARs by stopping the ColdFusion application server and deleting the respective JARs from cf_root/lib/updates. You can then revert to the backed up CFIDE, WEB-INF and lib directory files.
