you won't lose any security patches by applying just SP2.

SP2 includes up to post SP1 CU9, if you were at a later CU than that just applying SP2 CU1 will cover it. I would report this to MS, but you are probably giving yourself a problem you don't need to get into by trying to apply CU5.