(cherry picked from commit a88e319)

(cherry picked from commit 46d9141)

CVE-2019-13012 Description:

The keyfile settings backend in GLib before 2.59.1 creates directories
using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and
files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE,
G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL).
Consequently, it does not properly restrict directory (and file) permissions.
Instead, for directories, 0777 permissions are used; for files, default file
permissions are used.

Patch Summary:

Changes the permissions when a directory is created,
using 700 instead 777 in gio/gkeyfilesettingsbackend.c
and changes test to run in a temp directory in gio/tests/gsettings.c.

Upstream Issue: https://gitlab.gnome.org/GNOME/glib/issues/1658
Upstream MR: https://gitlab.gnome.org/GNOME/glib/merge_requests/604

Fixes #64657

Update distutils patch to the upstream changes.
See: python/cpython@6c0e0d1

(cherry picked from commit 7094a1a)

https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.43_release_notes
(cherry picked from commit 354ccb2)

(cherry picked from commit 979970a)

(cherry picked from commit 442fd85)
Fresh nss will be needed for further Firefox updates; /cc PR #64742

https://www.mozilla.org/en-US/firefox/60.8.0/releasenotes/
(cherry picked from commit 538c8ae)
Brief testing on 19.03 showed no problems.