Check this MOS note: Error Correction Policy and Lifetime Support Policy FAQ for Oracle JRockit 5.0 and 6 [ID 1450360.1]
1. How does the Oracle Error Correction Policy affect Oracle JRockit?
Oracle JRockit is supported on a Java SE version basis, as made explicit in the Lifetime Support Policy, and as such does not depend on the version of the JRockit JVM. Security updates and bug fixes are consolidated and released as rolling patches, rather than as patch sets which is done by other Oracle Fusion Middleware products. The rolling patches follow the standard Oracle Critical Patch Update schedule.
To receive a patch for Oracle JRockit you need to run with the latest available rolling patch of Oracle JRockit or a rolling patch that is still in the grace period. The grace period for Oracle JRockit is 1 year for new major releases of the bundled JRockit JVM, e.g. R27 and R28, and 3 months for rolling patch releases.
Since 28.2.3 was release more than 3 months ago I would think that you would need to upgrade to the latest release.