Do you recall when the TimThumb exploit occurred? Which versions of WordPress bundled with this exploit? I need to inform a client that they should be upgrading to at least the version of WP when this exploit was patched.

Yes, I'm aware of the separate issue where TimThumb is also used in plugins -- that's a separate issue. I'm talking about the TimThumb used inside WP in older versions.