How to know which security updates to install?

Question

I am using KB2977316 and KB3045324 for this example. These are security updates for SQL Server 2014 RTM.

• KB2977316 is version 12.0.2381.0 published 6/2/2015
• KB3045324 is version 12.0.2269.0 published 7/13/2015

If I have a SQL Server 2014 RTM system, do I need to install both of these, just the last one released, or the one with the highest version number? The 2381 update is a 600 MB download, while the 2269 version is 183 MB, so logic would dictate that 2269 does not contain all of the fixes included in 2381 and I need to install both. I guess what's throwing me off is that it just seems odd to have the version number decrease as newer updates are installed.

Please limit scope of answers and comments to security updates only. This question has nothing to do with CUs or SPs (other than that different security updates will apply based on the specific CU or SP level). Thanks!

Answer 1

Part of my mistake was in comparing QFE and GDR builds and release dates. The QFE downloads are much larger (~600 MB) than the GDR downloads (~200 MB). The dates and build numbers vary widely as well

I found the information at Latest Builds of SQL Server 2014 quite helpful. So just comparing the related security bulletins and GDR releases:

ms14-044 gdr = 183 MB   build 2254  8/12/2014
ms15-058 gdr = 205 MB   build 2269  7/13/2015

The one released on the later date is the higher version. I'm not yet sure how the person that maintains the page deduced that build 2269 includes the fixes from build 2254, so perhaps someone can comment on that or edit this answer.