Delete all the files & folders inside your original Drupal instance except for /sites and its sub-folders.
Warning: If your Drupal installation is built from a distribution your site will break if you delete the /profiles folder. Don’t delete the profile folder that corresponds to the distribution you installed, for example /profiles/kickstart if you installed Drupal Commerce Kickstart.
Copy all the folders and files except /sites from inside the extracted Drupal package [tar ball or zip package] into your original Drupal instance location.
Some updates do not include changes to setting.php and some do. If the update release includes changes to settings.php you will need to replace your old settings.php in …/sites/default/ with the new one, and then edit the site-specific entries (eg database name, user, and password) in the setting file.
If you have modified files such as .htaccess or robots.txt re-apply those changes to the new files.
If you have a favicon.ico file that was deleted replace it too