Cumulative hot fix 3 | ColdFusion 9

ColdFusion 9.0 Cumulative hot fix 3 (Release date: March 8 2013) includes support for Google Maps JavaScript API v3 and JDK 1.7 Update 15. This cumulative hot fix also includes few fixes that were not part of the previous hot fix. This cumulative hot fix is specific to ColdFusion 9.0.

What's new

  1. JDK 1.7: With ColdFusion 9.0 Cumulative hot fix 3, ColdFusion 9.0 is now certified on JDK 1.7 Update 15.

Note: JDK 1.7 is only supported on Mac OS X 10.7.3 and later. See this article for more details. ColdFusion 9.0 does not support Mac OS X 10.7. Therefore, Cumulative hot fix 3 does not certify ColdFusion 9.0 with JDK 1.7 on Mac OS X.

  1. Google Maps v3 support:
    1. With ColdFusion 9.0 Cumulative hot fix 3, Google Maps JavaScript API library is upgraded from v2 to v3.
    2. For Google Maps JavaScript API v3, the API key used for Google Maps API v2 no longer works.
    3. ColdFusion map functions and ColdFusion map related tags are backwards compatible. If your ColdFusion application uses native Google Maps JavaScript APIs, ensure that the code base is updated to v3. For more information, see the Google Maps JavaScript API v3 migration document.

Cumulative hot fix 3 consists of previously released fixes for the Security issues mentioned in the bulletins APSB11-29, APSB12-06, APSB12-15, APSB12-21, APSB12-26, and APSB13-03. There are also a few fixes that were not part of Cumulative hot fix 2.

Bug ID Description Added in Cumulative hot fix
3508603 ColdFusion AJAX Javascript functions ColdFusion.Map.getLatitudeLongitude and ColdFusion.Map.setCenter do not work on Google Maps v3 3
81860 Struct keys, cfswitch cases, and variable names are associated with incorrect values 3
APSB13-03 Security fix addresses vulnerabilities that could permit an unauthorized user to remotely circumvent authentication controls, potentially allowing the attacker to take control of the affected server. 2
APSB12-26 Security fix resolves a vulnerability which could result in a sandbox permissions violation in a shared hosting environment. 2
APSB12-21 Security fix resolves a vulnerability which could result in a Denial of Service condition. 2
APSB12-15 Security fix resolves an HTTP response splitting vulnerability in the ColdFusion Component Browser. 2
APSB12-06 Security fix resolves a vulnerability which could lead to a denial of service attack using a hash algorithm collision. 2
APSB11-29 Security fix resolves vulnerabilities which could lead to a cross-site scripting attack. 2
3085328 cfdocument tag throws an exception when generating PDF with textarea. 2
80624 Fix for the NullPointerException error thrown when deploying a car file from ColdFusion 7 containing data sources to ColdFusion 9 1
80621 Fix for the issue where ColdFusion was ignoring local variable assignment when the variable is assigned to a struct at runtime 1
80601 Fix for the “java.util.regex.PatternSyntaxException: Illegal repetition{}” error thrown when using {} as delimiter with the listtoarray function 1
80429 Fix for the issue where in any cfscript style function declarations, function parameter types were not accepting the dotted CFC type 1
80412 Fix for the issue where ColdFusion deployed on JBoss was unable to render maps using cfmap 1
80375 Fix for the “Error casting an object of type java.lang.Double cannot be cast to  java.lang.String to an incompatible type” error thrown when calling a CFC remotely with returnFormat=json 1
80335 Fix for the issue where an implicit struct/array passed to a function call as a value is not working 1
80231 Fix for the issue where cfscript style function declaration was not accepting implicit struct/array as a default value for the second argument onward 1
80230 Fix for the “ashx image format is not supported on this operating system” error thrown when assigning an image returned from a .NET webservice to a CFImage tag 1
79756 Fix for the “Cannot drop the table '<tableName>'” error thrown when requesting the CFC for the first time with the ORM setting dbcreate set to dropcreate 1      

Installation instructions

The installation process is the same for all platforms and installation choices. Follow the instructions below to apply the fix.



  1. and included in the hot fix contains only part of the CFIDE and WEB-INF files. Do not rename present CFIDE or WEB-INF folders to create a backup as per the instructions.
  2. Named application scope is not available in servlet context by default. To roll back to the previous state, add JVM flag -Dcoldfusion.allowappdatainservletcontext=true.

Definition of ColdFusion-Home

In the following procedures, {ColdFusion-Home} indicates the following:

  • For Server installation: {ColdFusion-Home}
  • For Multiserver installation: {JRun-Home}/servers/{YourServer}/cfusion-ear/cfusion-war/
  • For JEE installation: {cfusion-ear-Home}/cfusion-war/
  1. Download and Extract both zip files.
  2. In ColdFusion Administrator, select System Information page by clicking the icon "i" in the upper-right corner.
  3. In the "Update File" text box, browse and select chf9000003.jar located under CF9/lib/updates.
  4. Click Submit Changes.
  5. Stop the ColdFusion instance.
  6. Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If chf9000001.jar, chf9000002.jar, hf900-81860.jar, hf900-00001.jar, hf900-00002.jar, hf900-00003.jar, hf900-00004.jar, hf900-00005.jar, hf900-00006.jar, hf900-00007.jar, hf900-00008.jar, hf900-00009.jar exist, move them to a backup location. Otherwise, ignore this step.
  7. Go to {CFIDE-HOME} and take a backup of CFIDE folder.
  8. Extract all the files in to merge in the web root directory that has {CFIDE-HOME} folder.
  9. Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and take a backup of WEB-INF folder.
  10. Go to CF9 directory, extract, and merge all the files in to {ColdFusion-Home}/wwwroot (for Server Install) and {ColdFusion-Home} (for MultiServer and J2EE installations) directory.
  11. Go to your {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) and take a backup of, flex-messaging-common.jar, flex-messaging-core.jar, ib6core.jar, ib6http.jar, ib6swing.jar and ib6util.jar.
  12. Go to CF9/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install).
  13. If you want to configure ColdFusion with JDK 1.7, refer this article for further instructions. Otherwise, ignore this step.
  14. Start the ColdFusion Instance.
  15. If there are multiple instances, repeat steps 2 through 14 for each instance.

You may get the following error when starting a ColdFusion instance configured with JDK 1.7:

"MSVCR100.dll is missing."

To resolve this, copy msvcr100.dll from {JDK Home}\jre\bin to {ColdFusion-Home}\runtime\bin.

Uninstall Cumulative hot fix 3

To uninstall the Cumulative hot fix:

  • Stop the ColdFusion instance.
  • Delete the chf9000003.jar file at {ColdFusion-Home}/lib/updates. Revert to the backed up jar files mentioned in the Step 6 of the installation instructions above.
  • Revert to the backed up CFIDE, WEB-INF and lib directory files, mentioned in the Steps 7, 9, and 11.
Adobe logo

Sign in to your account