I don't know of a tool and I don't think there is one. If you enter 'build list' in the search bar on this site I will bring up a full list of service packs and security hotfixes.

Basically you should apply service packs and all security patches, apply Cumulative updates or hotfixes only if you hit the issue they resolve, so in your case apply SP4 + MS11-049.

If the client is not sure apply it in a test environment first and test. Service packs are thoroughly tested by microsoft so are safe to apply.

Google MS11-049 and show them the MS information on it as to why they should apply it (its a security patch)