com.liferay.portal.kernel.util.ReleaseInfo internally has access to release information including the installed update (for 7.4). This is not exposed. In order to figure out the exact version at runtime, you'd either need to parse the output of ReleaseInfo.getReleaseInfo() (which concatenates all kinds of information, currently to 97 characters), or use the following Reflection code:
(add exception handling to taste)
Result in this case, for example: "7.4.13 Update 1"
This is not particularly pretty code, but the only method I've found to detect the exact version at runtime that doesn't rely on parsing whatever format ReleaseInfo.getReleaseInfo() returns.
The information is valuable and should be provided by ReleaseInfo without jumping through hoops.