This page has a list of the patches, for 9.02 is up to update 4.
http://www.adobe.com/support/security/bulletins/apsb13-10.html
I'm not familiar with that jar file and updates so I don't know if it
is the latest.
On this page:
http://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix-apsb13-10.html
scroll down to
ColdFusion 9
If you have applied the previous Security hot fix APSB13-03, see
Section 1. If you have not applied the previous Security hot fix
APSB13-03, see Section 2.
If you are running 9.0.2, beware before applying this update: the
cf902.zip file listed there is supposed to have a web-inf.zip within
it (as indicated in the instructions) at the beginning of 2013, they
might have fixed it by now.
And follow these instructions, (it has file names for an older hotfix
just replace it with your current one)
ColdFusion 9.0.2
1. Download CF902.zip and CFIDE-902.zip. Extract both zip files.
2.In ColdFusion Administrator, select System Information page by
clicking the icon "i" in the upper-right corner.
3. In the "Update File" text box, browse and select hf902-00003.jar
located under CF902/lib/updates.
4. Click Submit Changes.
5. Stop the ColdFusion instance.
6. Go to {ColdFusion-Home}/lib/updates (for Server installation) or
{ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and
J2EE installations) directory. If hf902-00001.jar, hf902-00002.jar
exist, delete it. Otherwise, ignore this step.
7. Go to {CFIDE-HOME} and take a backup of CFIDE folder.
8. Extract all the files in CFIDE-902.zip to merge in the web root
directory that has {CFIDE-HOME} folder.
9. Start the ColdFusion Instance.
10. If there are multiple instances, repeat steps 2 through 9 for each
instance.