For anyone wondering, this comes with GPG 2.0.19, 2.0.20 came out on May 10th 2013 with a security fix: http://www.cvedetails.com/cve/CVE-2012-6085/

I believe they've patched it in this release though: http://support.gpgtools.org/discussions/everything/4323-cve-...

It's disappointing that their release notes don't mention this.