Sure. 3.6.9 (which was affected) was the most recent iTerm2 when that CVE came out.