A priority 2 update addressing an important vulnerability in ColdFusion 9 and above is released today. Adobe recommends to update the ColdFusion servers. Here is the link for security bulletin.
This hot fix resolves a vulnerability which could result in a sandbox permissions violation in a shared hosting environment - CVE-2012-5676. As a result to this fix named application scope will not be available in servlet context. This might affect applications using JSP interoperability.
For ColdFusion 10, use updater to get this update. This is update 6 and it contains previous updates for ColdFusion 10.
"Could not access a java object field called allowAppDataInServContext."
Can you please confirm if old hf jars are deleted?
"1) Download CF901.zip and extract hf901-00007.jar file.
2) In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper-right corner.
3) In the update file text box, browse and select hf901-00007.jar and click Submit Changes.
4) Restart the ColdFusion instance.
5) If there are multiple instances, repeat steps 2 through 4 for each instance."
It doesn't say anything about deleting old HF files so yes the previous hf901-00006.jar was still there.
I've deleted it now and everything works fine.
Could you include that step in the instructions?
Sure i will get it checked and updated.