Online-note-sharing company Evernote has patched a hole that allowed attackers to infect notes shared via its service.