ColdFusion 11 Update 3 and ColdFusion 10 Update 15 are available now

This post is to announce the availability of new updates to ColdFusion 11 and ColdFusion 10.

ColdFusion 11 Update 3

Most awaited update of ColdFusion 11 is available now. It includes support for JDK 8, Tomcat 7.0.54 and other platforms/servers/databases besides ~195 bug fixes (internal and external) in AJAX, Charting, Caching, Database, Language, Mobile Support, Net Protocols, Security and other areas.

For more details, refer this article.

ColdFusion 10 Update 15

This update includes a fix for vulnerability mentioned in the security bulletin APSB14-29.

For more details, refer this article.

94 Responses

  1. Just to verify before I upgrade my OS X from 10.9 to 10.10, cf11 update 3 will now work on it correct? I know the update was just released but on the website it doesn’t have that listed yet and wanted to confirm.

  2. Just to reinforce the issue @Anit, “Download and Install” called download.cfc via the browser, but didn’t do anything. “Download” worked, but then “install” didn’t do anything at all. After a page refresh, “install” worked. Also one more thing, this update will not install if the lockdown guide is followed. The service must be set to “Service” login in order for the update to run.

  3. I ran into an issue on my local dev CF11 setup. I had the pre-release of update 3 installed. When I used the Uninstall option in the CF Admin it appeared to work, but when CF 11 restarted I all I got was a TomCat error. “failed: Connection refused: connect“”

    The only way I could fix this was to shut down all the CF11 services and manually copy the backup files from “{cfinstance}hf-updateshf-11-00003backup” to the instance root and overwrite existing files. Once I did that CF11 worked again and I was able to successfully install Update 3.

  4. I updated the first of my dev boxes, which is a Mac OS X 10.9.5 system running Java 1.7.0_72 with CF deployed via WAR on stock Apache Tomcat 7.0.57. I downloaded the CF10u15 updater from within the CF admin, then signed out of the admin, and stopped Tomcat and CF. Ran the updater from the command-line by

    $ cd {path-to}/webapps/ROOT/WEB-INF/cfusion/hf-updates
    $ java -jar ./hotfix_015.jar -i GUI

    Installer completed but indicated errors occurred. Looking at the install log in the hf-updates/hf-10-00015/ folder, I see the following down near the very bottom of the log file:

    Custom Action: com.adobe.utils.Logger
    Status: ERROR
    Additional Notes: ERROR – class com.adobe.utils.Logger.install() runtime exception:

    I can start CF w/o any problem, sign in on the CF admin, and I’ve verified that a few small CF files run as expected but have not done any significant testing yet.

    Questions for the Adobe CF team:
    (a) Is this cause for concern? Something clearly failed
    (b) Can I have someone from Adobe CF team take a look at the update log and let me know what’s amiss?


  5. Have the same error as Ron with CF10u15:

    Custom Action: com.adobe.utils.Logger
    Status: ERROR
    Additional Notes: ERROR – class com.adobe.utils.Logger.install() runtime exception:

  6. Since installing this update (and reconfiguring web connectors) websockets doesnt appear to work at all. When going to the websocket settings in the administrator page a 500 error occurs and the following is displayed in the logs.

    ‘ The specific sequence of files included or processed is: C:ColdFusion11cfusionwwwrootCFIDEadministratorsettingswebsocket.cfm, line: 71

  7. We also had some problems with the auto-update because of permission issues on a locked-down server.

    1. The installer just “hanged” after downloading the hotfix while displaying “Checking”, which is not so nice for debugging.
    2. We finally found a workaround and applied the update via command line (which is kind of ugly, but at least seemed to work without problems). Those 2 blog posts helped with the manual installation:

  8. Just as a further note to my last comment. Seems this is the source of the problems when the CF server is restarted:

    Error [localhost-startStop-1] – Unable to initialise WebSocket service: coldfusion.server.ServiceException: Seed passed for encryption in null.

  9. Regarding Yosemite support, just thought I’d flag for users thinking of upgrading their OS that there are some bugs and we’ve not been able to find the cause – you might want to hold off upgrading if you can.

    Certain image functions – such as writeToBrowser and imageRead – do not work, cause Java errors (java.lang.ClassNotFoundException: and fail silently. We also struggled to get it to work on any other JRE in Yosemite strangely.

    We spent a good amount of time looking into it yesterday but couldn’t establish a cause. We have the same version of CF and Java running on a Mavericks machine without any problems, but every Yosemite machine has the same issue, so can only assume there is still a compatibility issue with Yosemite and CF.

    There is a bug entry which gives a bit more info – although actually this bug was flagged for Mavericks:

    Feels like this is solvable for someone with good Java knowledge as it seems it’s a case of missing a link to some Java classes – most of CF works fine. Would be great to get some eyes on it ASAP. Thanks, H

  10. Where is the update connector source ?
    This was missing from previous updates, and there’s no mention of it for this one either, and it’s not present in wsconfig.jar

  11. We were shipping Microsoft VC++ Redistributable 2012 with Update 14 which is not required anymore. So, we have removed it from the hotfix installer. That is why, you are observing a huge difference in the installer size.

  12. Ran into issues re-configuring the JRun connector on both servers we attempted to install this on. After a combination of reboots and running WSCONFIG as Administrator we were able to get it to work on one of them, but no matter how we tried to run the tool on the second we got the infamous 500 error that TW ran into above. We’re going to try again tonight. Anyone aware of any “gotchas” for running WSCONFIG that might help prevent the 500 error?

  13. @Nimit
    No, I never installed the CF11 update 3 preview, it only had CF11 update 2. But you’ve not updated the CF11 update 3 update so I wasn’t expecting anything to appear there ?

    Thanks for looking into the connector source issue. FYI it was missing from CF11’s release too and had to be supplied by the installation support team via cfinstal@ – I’ve already emailed them again but haven’t even got an auto reply back yet.

  14. Hi,
    I just recognized that on both ubuntu x64 machines the solr service did not start automatically after the Update 15 to CF10. I had to start cfjetty manually.
    As these are production machines, I cannot say more at the moment. But this never happened before…

  15. Jörg,
    The updater should not have stopped the Solr service in the first place. There were no jetty related changes in Update 15. You can refer the list of modified files at /cfusion/hf-updates/hf-10-00015/hotfix_filelist.log.
    I have verified this behavior on Ubuntu 13.10 x64 with HF15.

    Is you Search service installed in the default location at /cfusion/jetty? The start.log file in the logs directory in same location should have recorded the time of the start/stop event. Can you check when it was stopped? Does that time correspond with the time of the update installation?

    Can you please also check the update install logs, at /cfusion/hf-updates/hf-10-00015, for errors.

  16. Release Notes should document that “ColdFusion 11 Update 3 is embedded in the full installer”.

    And, under the Installed Updates tab, this:

    Backup Directory: Update 3 Embedded. No uninstall or backup directory
    Uninstaller Location: Update 3 Embedded. No uninstall or backup directory uninstalluninstaller.jar
    Install Log: Update 3 Embedded. No uninstall or backup directory hotfix_filelist.log

    Should probably be changed to this:

    Backup Directory: Update 3 Embedded. No uninstall or backup directory.
    Uninstaller Location: Update 3 Embedded. No uninstall or backup directory.
    Install Log: Update 3 Embedded. No uninstall or backup directory.

    1) the “uninstalluninstaller.jar” and “hotfix_filelist.log” should be removed
    2) all lines should end w/ “.”

    #2 is caused by updates.xml containing:
    Update 3 Embedded. No uninstall or backup directory


  17. Update 3 for ColdFusion 11 breaks DDX Functions. No isDDX() or cfpdf action=”processddx” is working anymore. Even simple samples from the cf documentation aren’t working anymore. Uninstalled CHF3 and everything working again.

    For future updates I would prefer that Adobe is releasing security hotfixes, like the one for CVE-2014-9166, independently from product updates. Installing CHF3 breaks our applications and not installing makes us vulnerable to attacks.


  18. Reto’s comment above :

    “For future updates I would prefer that Adobe is releasing security hotfixes, like the one for CVE-2014-9166, independently from product updates. Installing CHF3 breaks our applications and not installing makes us vulnerable to attacks. ”

    also implies that we _need_ be able to apply updates selectively and independently. The latest update should not include all previous updates, as is now the practice.

  19. @Nando
    Being able to pick and choose at random from amongst the possible updates is a recipe for complexity nightmares I’d rather the CF team didn’t worry about.

    What should happen is fixes come out in strict order, one at a time, that we you’d only need to apply updates from the current state as far as the CVE fix. You could hold off on the rest.

    But to do that you need more frequent smaller updates, which doesn’t seem to be on the cards.

  20. @Tom
    Perhaps you have a point. I don’t have the experience to judge. But what happens if update 3 breaks your application and update 4 is an essential security update? Reto would be in the same position as he is today, stuck at update 2.

  21. Installed the update and it works great! Checked the Build Number and we are definitely running CF11 Update 3 now.

    Just one issue. Update 3 still shows as “Available Updates” in CF Administrator Panel. Refreshed browser, cleared cache, still there.

  22. Update 3 for Coldfusion 11 breaks cfstoredproc tag and produces ODBC/JDBC error:
    “Error”,”ajp-bio-8014-exec-1″,”12/12/14″,”08:59:13″,”incinc”,”Error Executing Database Query.[Macromedia][SequeLink JDBC Driver][ODBC Socket][Oracle][ODBC]Syntax error or

    access violation.

    Uinstalled CFH3 and cfstoredproc tag use works fine. Running on Windows 2012 R2 and Apache 2.4.10. Anybody have similar problem?

  23. @Nimit Sharma: After running the update from the command prompt, the update installed and I’m running ColdFusion 11,0,03,292480.

    I removed and re-added the web server connector. Do you know a quick way I can ensure that we are, indeed, running Tomcat Tomcat 7.0.54? Thanks!

  24. @Dan,
    The mod_jk.conf file has not changed in update 15.

    The connectors though, are changed and would need reconfiguring.
    This is reflected in the file modified date for The connector version continues to be 1.2.40.

  25. Trying to recreate the connector on CF11u3 and Windows 2012 R2/Apache 2.4.10, but it does not create the file.

    Here is command example (IPs changed):
    wsconfig.exe -ws Apache -dir “C:Program FilesApache Software FoundationApache2.4conf” -bin “C:Program FilesApache Software FoundationApache2.4binhttpd.exe” -allowedIPList,,333.33.333.3,444.44.444.4

    This worked fine before the update.

  26. My concern with the removal of the IP restrictions file was the additional removal of what looked to be security related blocks that were in that file.


    I created a thread on the forum before I was pointed to this topic relating to this.

  27. Regarding comment 68 and 69 above, @Nimit Sharma suggested I fix my syntax usage of ‘dbvarname’ to include a leading colon since I am calling an Oracle Stored Procedure and CF11u3 now enforces this syntax.

    This syntax does not seem to work when calling the Stored Procedure through an ODBC connection. An ODBC connection is my only option since I am running CF11 Standard. Since it won’t work without the colon either, my workaround is to remove the use of ‘dbvarname’, calling the SP using positional parameters.

    Anybody else see this behavior?

  28. @Tom: It’s the Oracle drivers that aren’t in standard, not CFSTOREDPROC.

    @Gary: ODBC is not your only option. Just grab some Oracle JDBC drivers from somewhere else. It’s just that Adobe don’t license *their* Oracle drivers on Std Ed.


  29. CFSTOREDPROC is available, but using the dbvarname attribute of CFPROCPARAM (with or without prepended colon in the value for Oracle) produces the error noted in comment 68 above. But only through an ODBC connection, no problem when using the Oracle driver.


    . . .

  30. Apparently not, just trying to confirm with others when using Oracle’s ODBC driver. I guess I’ll need to try the install Oracle JDBC route or just use positional param calls.

  31. After installing the update, received CF error that the CFInstances method wasn’t found. I reverted back, but am in a position where I can’t update. I have a locked down CF11 update 2 box. Do I need to change service accounts? Do I need to go via the command-line? help please!

  32. I am getting an error on the updates page in CF Admin.
    I copied the hotfix file from another server and installed it from the command line.
    The error on the updates page is:
    Element UPDATES is undefined in SESSION.

    The error occurred in _updates.cfm: line 283
    Called from index.cfm: line 150
    Called from index.cfm: line 143
    Called from index.cfm: line 52
    Called from index.cfm: line 51
    Called from index.cfm: line 1

    -1 : Unable to display error’s location in a CFML template.

Leave a reply