Recent patches for vulnerability attacks for SQL Server 2014 SP2 version
You need both SQL and Windows patches, as well as CPU microcode updates, to be fully** protected.

GDR is meant to be security-only patches, whereas Cumulative Updates are bug fixes as well as security patches. Once you go from the GDR path on to the CU path, you're stuck there, i.e. you can't go back to GDR only.

(Confusingly, this latest Meltdown / Spectre update shows up on certain SQL Server versions as a GDR and CU update.)

If you are already on a CU, then stick with CU update.

** Note that Microsoft is rolling back the Meltdown / Spectre updates on Windows Update because there are some issues with certain CPUs, so it's hard to tell whether you were one of the lucky ones to get them while they were up. See the warning below.

Use this link to check if you're fully patched, using a PowerShell script from Microsoft.

The link includes the following statement:


  Customers must take the following actions to help protect against the
  vulnerabilities:
  
  
  Verify that you are running a supported antivirus application before
  you install operating system or firmware updates. Contact the
  antivirus software vendor for compatibility information.
  Apply all
  available Windows operating system updates, including the January 2018
  Windows security updates.
  Apply the applicable firmware update that is
  provided by the device manufacturer.
  


And this warning:


  Customers who only install the Windows January 2018 security updates will not receive the benefit of all known protections against the vulnerabilities. In addition to installing the January security updates, a processor microcode, or firmware, update is required. This should be available through your device manufacturer.