More specifically it's a problem with the mbstring library (IIRC). What's more, if your host still has that bug, then it clearly doesn't have much of an interest in staying up to date, especially where security is concerned, so I'd consider the adventure of finding a new host.