Cumulative hot fix 4 | ColdFusion 9.0.1

Search
ColdFusion 9 User Guide
Applies to: ColdFusion 9

某些 Creative Cloud 应用程序、服务和功能在中国不可用。

ColdFusion 9.0.1 Cumulative hot fix 4 (Release date: March 8 2013) includes support for Google Maps JavaScript API v3 and JDK 1.7 Update 15. This cumulative hot fix also includes few fixes that were not part of the previous hot fix. This cumulative hot fix is specific to ColdFusion 9.0.1.

What's new

  1. JDK 1.7: With ColdFusion 9.0.1 Cumulative hot fix 4, ColdFusion 9.0.1 is now certified on JDK 1.7 Update 15.

Note: JDK 1.7 is only supported on Mac OS X 10.7.3 and later. See this article for more details. ColdFusion 9.0.1 does not support Mac OS X 10.7 (see the Support Matrix). Therefore, Cumulative hot fix 4 does not certify ColdFusion 9.0.1 with JDK 1.7 on Mac OS X.

  1. Google Maps v3 Support
    1. With ColdFusion 9.0.1 Cumulative hot fix 4, Google Maps JavaScript API library is upgraded from v2 to v3.
    2. For Google Maps JavaScript API v3, the API key used for Google Maps API v2 no longer works.
    3. ColdFusion map functions and ColdFusion map related tags are backwards compatible. If your ColdFusion application uses native Google Maps JavaScript APIs, ensure that the code base is updated to v3. For more information, see the Google Maps JavaScript API v3 migration document.

Note:

 

  • Cumulative hot fix 4 consists of previously released Cumulative hot fixes and Security hot fixes mentioned in the bulletins APSB11-29, APSB12-06, APSB12-15, APSB12-21, APSB12-26, and APSB13-03. There are also a few fixes that were not part of Cumulative hot fix 3.
  • Cumulative hot fix 4 also addresses issues (3511975, 3508592) reported with Cumulative hot fix 3.

Bug ID  Description  Added in Cumulative hot fix 
3508603 ColdFusion AJAX Javascript functions ColdFusion.Map.getLatitudeLongitude and ColdFusion.Map.setCenter do not work on Google Maps v3 4
APSB13-03 Security fix addresses vulnerabilities that could permit an unauthorized user to remotely circumvent authentication controls, potentially allowing the attacker to take control of the affected server. 3
APSB12-26 Security fix resolves a vulnerability which could result in a sandbox permissions violation in a shared hosting environment. 3
APSB12-21 Security fix resolves a vulnerability which could result in a Denial of Service condition. 3
APSB12-15 Security fix resolves an HTTP response splitting vulnerability in the ColdFusion Component Browser. 3
APSB12-06 Security fix resolves a vulnerability which could lead to a denial of service attack using a hash algorithm collision. 3
APSB11-29 Security fix resolves vulnerabilities which could lead to a cross-site scripting attack. 3
3085328 cfdocument tag throws an exception when generating PDF with textarea. 3
APSB11-04 Security fix for cross-site scripting, session fixation, CRLF injection, and information disclosure. 2
APSB11-14 Security fix for cross-site request forgery (CSRF) or a remote denial-of-service (DOS). 2
APSB11-15 Security fix for unrestricted class creation during AMF/AMFX deserialization and complex  object graph vulnerabilities.  2
81110  ColdFusion throws “org.apache.bcel.generic.ClassGenException: Invalid branch target position offset for goto” exception if there is much code inside cfloop. 2
83094 ColdFusion throws ArrayIndexOutofBounds exception when cfstoredproc returns multiple result sets and application code uses duplicate function against the result set. 2
83185  CFFTP listDir action does not work with WFTPD ftp server. 2
83316  Cfexchangemail getAttachments action does not work with Outlook email messages attached to the email. All the .msg attachments are dropped. Issue is fixed only for Exchange 2003. 2
83425  Cfcontent or Cfheader throws 404 error when the file size is larger than 300 MB. 2
83447 CFFile Upload action doesn't accept files of 2 GB or greater regardless of value set for the “Maximum size of post data" in the administrator. 2
83474  ColdFusion ORM does not maintain the column order correctly when the CFC extends a base cfc with an attribute mappedSuperclass set to true. 2
83514  ColdFusion throws “java.lang.IllegalStateException: Session is invalid” exception randomly. 2
83693 ColdFusion throws an error during Solr indexing “org/apache/pdfbox/pdmodel/PDDocument null” whenever a file with .PDF extension is present in the path provided. 2
83772  Repeated runs of RandRange function when using SHAIPRNG causes function performance degradation. 2
83980  Intermittently cfmail tag does not set the MessageID correctly. 2
84277  Cfdocument tag does not honor the query param specified in the source url. 2
84856  Coldfusion does not honor gobal script protection if cfapplication tag is used and scriptprotection attribute is not set to true. 2
84949 ColdFusion throws variable ORGSPECDIR is undefined error when trying to register a remote instance with ColdFusion 9.0.1 2
85000  The response header for a ColdFusion page always shows a content-length of 8192 irrespective of how much data is actually being served. 2
85086  cfquery tag throws an error if both ormoptions and datasource attributes are set. 2
85099  ColdFusion does not resolve the CFCs fully qualified name correctly when a relative path is used in the application mapping. 2
85232  In a Custom tag, cftransaction rollback action does not work when clientstorage is configured with the database. 2
86744  Cfthread terminate action is not cleaning up the threads properly. 2
86898  SpreadsheetFormatColumn() function does not apply the date format correctly. 2
86921 When using IBM's Db2 connect JDBC driver with ColdFusion, it throws a Null Pointer exception when executing an insert or update on a DB2 mainframe database 2
87015  cfspreadsheet tag does not evaluate Excel’s percentile function. 2
APSB10-18 Security Fix for the directory traversal vulnerability that could lead to information disclosure. 1
83598 Setting default locale to en_GB results in Invalid Date Format error when you run a scheduled task. 1
83638 serializeJSON converts integer to string. 1
83650 Submitting a form inside a cflayout type=”hbox|vbox” results in a JavaScript error. 1
83671 If named arguments with implicit structs and arrays use local variables, it results in ‘variable is undefined’ error. 1
83689 cfdump does not display the changes to the functions for a CFC object. 1
83694 cfgrid sorting does not function as desired for static and dynamic data except when the data is retrieved from the database. 1
83725 If you send mails with inline images, the source image is deleted. 1
83747 ColdFusion ORM preUpdate event handler is called  twice when a persistent entity is updated within a cftransaction. 1
Note: This issue has been fixed for one data source per request use-case.
83818 ColdFusion debugger can fail if the file being debugged is repeatedly revised. 1
83829 cfwindow onShow method is called twice. 1
83836 serializeJSON incorrectly serializes nested objects. Also, in the case of circular references, for example, when handling bidirectional ORM relationship, repeating entities are represented as empty strings instead of empty objects. 1

Installation instructions

The installation process is the same for all platforms and installation choices. Follow the instructions below to apply the fix.

Note:

 

  1. CFIDE-901.zip and WEB-INF.zip included in the hot fix contain only part of the CFIDE and WEB-INF files. Do not rename present CFIDE or WEB-INF folders to create a backup as per the instructions.
  2. Named application scope is not available in servlet context by default. To roll back to the previous state, add JVM flag -Dcoldfusion.allowappdatainservletcontext=true.

Definition of ColdFusion-Home

In the following procedures, {ColdFusion-Home} indicates the following:

  • For Server installation: {ColdFusion-Home}
  • For Multiserver installation: {JRun-Home}/servers/{YourServer}/cfusion-ear/cfusion-war/
  • For JEE installation: {cfusion-ear-Home}/cfusion-war/
  1. Download CF901.zip and CFIDE-901.zip. Extract both zip files.
  2. In ColdFusion Administrator, select System Information page by clicking the icon "i" in the upper-right corner.
  3. In the "Update File" text box, browse and select chf9010004.jar located under CF901/lib/updates.
  4. Click Submit Changes.
  5. Stop the ColdFusion instance.
  6. Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If chf9010001.jar, chf9010002.jar, chf9010003.jar, hf901-00001.jar, hf901-00002.jar, hf901-00003.jar, hf901-00004.jar, hf901-00005.jar, hf901-00006.jar, hf901-00007.jar, hf901-00008.jar exist, move them to a backup location. Otherwise, ignore this step.
  7. Go to {CFIDE-HOME} and take a backup of CFIDE folder.
  8. Extract all the files in CFIDE-901.zip to merge in the web root directory that has {CFIDE-HOME} folder.
  9. Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and take a backup of WEB-INF folder.
  10. Go to CF901 directory, extract and merge all the files in WEB-INF.zip to {ColdFusion-Home}/wwwroot (for Server Install) and {ColdFusion-Home} (for MultiServer and J2EE installations) directory.
  11. Go to your {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) and take a backup of given files, if present log4j.properties, validation.properties, ESAPI.properties, commons-fileupload-1.2.jar, esapi-2.0_rc10.jar, jpedal.jar, flex-messaging-common.jar, flex-messaging-core.jar, ib6core.jar, ib6http.jar, ib6swing.jar, and ib6util.jar.
  12. Download jpedal.zip, extract the file and merge to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) directory.
  13. Go to CF901/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install).
  14. If you wish to configure ColdFusion with JDK 1.7, refer this article for further instructions. Otherwise, ignore this step.
  15. Start the ColdFusion Instance.
  16. If there are multiple instances, repeat steps 2 through 15 for each instance.

Note:

You can get the following error when starting a ColdFusion instance configured with JDK 1.7:

"MSVCR100.dll is missing."

To resolve this issue, copy msvcr100.dll from {JDK Home}\jre\bin to {ColdFusion-Home}\runtime\bin.

Uninstall Cumulative hot fix 4

To uninstall the Cumulative hot fix:

  • Stop the ColdFusion instance. 
  • Delete the chf9010004.jar file at {ColdFusion-Home}/lib/updates. Revert to the backed up jar files mentioned in the Step 6 of the installation instructions above.
  • Revert to the backed up CFIDE, WEB-INF and lib directory files, mentioned in the Steps 7, 9, and 11.

Revision:

March 11 2013: Step 12 added to the installation instructions.

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License  Twitter™ and Facebook posts are not covered under the terms of Creative Commons.

Legal Notices   |   Online Privacy Policy