Which release fixed CVE-2010-5141 (attacker can spend any coin)
The 0.3.7 update does indeed fix the script execution bug that is being described, the vulnerable code below is removed and replaced with functions that execute the scriptSig and then the scriptPubKey on the same stack. 

if (!EvalScript(txin.scriptSig + CScript(OP_CODESEPARATOR) + txout.scriptPubKey, txTo, nIn))


Previously what would happen is that the two script tapes were literally concatenated, then executed as one. The problem here is simply that we can use a trailing OP_PUSHDATA in the scriptSig push the entire scriptPubKey to the stack as a single data element rather than discrete opcodes. Our scriptSig would simply be a push opcode for the length of the scriptPubKey plus an OP_CODESEPERATOR. At the end of execution the only element remaining on the stack is not zero, so the evaluation returns true and we can spend any coins we like.